All vulnerabilities
CVE-2025-49655GHSA-cvhh-q5g5-qprpPYSEC-2026-368

Keras framework vulnerable to deserialization of untrusted data

Keras keraspipLibraries & packages
Open in ThreatlineRecord JSON
CVSS
9.8Critical
ExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 17 Oct 2025. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.75%Chance of exploitation activity in the next 30 days, higher than 54% of CVEs. Scored 27 Oct 2026FIRST EPSS
Fixed in3.11.3Fixed versionGitHub
Published17 Oct 2025Updated 27 Oct 2026CVE List

What fixes it

  • 3.11.3keras, pipGitHub
  • 3.11.3KerasCVE List
  • 3.11.3keras, PyPIOSVpip install "keras>=3.11.3"

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Deserialization of untrusted data can occur in versions of the Keras framework running versions 3.11.0 up to but not including 3.11.3, enabling a maliciously uploaded Keras file containing a TorchModuleWrapper class to run arbitrary code on an end user’s system when loaded despite safe mode being enabled. The vulnerability can be triggered through both local and remote files.

Text from CVE List

Affected versions 6

  • keras, pip>= 3.11.0, < 3.11.3GitHub
  • Kerasaffected: 3.11.0 before 3.11.3CVE List
  • keras, PyPIfrom 3.11.0, fixed in 3.11.3OSV
  • keras, PyPI3.11.0OSV
  • keras, PyPI3.11.1OSV
  • keras, PyPI3.11.2OSV

References 7