N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-pwq7-2gvj-vg9v

GHSA-pwq7-2gvj-vg9v: Duplicate Advisory: Keras safe mode bypass vulnerability

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-c9rc-mg46-23w3. This link is maintained to preserve external references.

Original Description

A safe mode bypass vulnerability in the Model.load_model method in Keras versions 3.0.0 through 3.10.0 allows an attacker to achieve arbitrary code execution by convincing a user to load a specially crafted .keras model archive.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-pwq7-2gvj-vg9v

GHSA-pwq7-2gvj-vg9v:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
keras	pip	>= 3.0.0, < 3.11.0	3.11.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a safe mode bypass in Keras's model deserialization process, allowing for arbitrary code execution. The root cause lies in the _retrieve_class_or_fn function within keras/src/saving/serialization_lib.py. This function was responsible for dynamically loading classes specified in a .keras model file. Before the patch, it lacked proper validation and would load any class from any module, which is a classic deserialization of untrusted data vulnerability (CWE-502).

The patch, identified in commit 713172ab56b864e59e2aa79b1a51b0e728bba858, mitigates this by introducing a strict check. It ensures that any class being deserialized is a subclass of KerasSaveable. This change restricts the types of objects that can be created during deserialization to known, safe Keras components.

The primary entry point for this vulnerability is the keras.saving.saving_lib.load_model function, which is the public API developers use to load models. An attacker would convince a victim to load a malicious model file using this function. During a runtime analysis of an exploit, both load_model and the underlying _retrieve_class_or_fn would appear in the execution profile, with the former being the trigger and the latter being the exact location of the security flaw.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.