CVE-2025-8747: Keras safe mode bypass vulnerability

The vulnerability is a classic case of unsafe deserialization of untrusted data. The root cause is in the _retrieve_class_or_fn function within keras/src/saving/serialization_lib.py, which was responsible for dynamically loading classes needed to reconstruct a Keras model from a .keras file. The original implementation did not validate the classes being loaded, allowing an attacker to craft a model file that, when loaded, would cause Keras to instantiate arbitrary classes, leading to remote code execution.

The patch addresses this by introducing a KerasSaveable mixin class. The _retrieve_class_or_fn function was modified to check if the class being loaded is a subclass of KerasSaveable. This ensures that only classes explicitly marked as safe for deserialization by the Keras developers can be loaded, effectively blocking the loading of arbitrary, and potentially malicious, classes.

The primary entry point for an attack is the keras.models.load_model API, which is what a user would call to load a model. This function would appear at the top of a stack trace during exploitation, followed by deserialize_keras_object and finally the core vulnerable function, _retrieve_class_or_fn.