CVE-2025-9905

The Keras Model.load_modelmethod can be exploited to achieve arbitrary code execution, even with safe_mode=True.

One can create a specially crafted .h5/.hdf5model archive that, when loaded via Model.load_model, will trigger arbitrary code to be executed.

This is achieved by crafting a special .h5archive file that uses the Lambdalayer feature of keras which allows arbitrary Python code in the form of pickled code. The vulnerability comes from the fact that the safe_mode=Trueoption is not honored when reading .h5archives.

Note that the .h5/.hdf5format is a legacy format supported by Keras 3 for backwards compatibility.