A vulnerability in Keras allows for arbitrary code execution through unsafe deserialization of untrusted PyTorch data structures.

This flaw stems from improper deserialization of untrusted data (CWE-502). The affected method invokes torch.load with weights_only=False, which permits the execution of arbitrary code when processing malicious Keras layer configurations that are not properly sandboxed.

With a CVSS score of 7.8, this vulnerability poses a significant risk to machine learning pipelines and development environments. An attacker who can influence the model configuration files can achieve arbitrary code execution on the host system, potentially leading to unauthorized data access or the compromise of the underlying compute infrastructure.

Immediate Action: Update to the latest version of Keras that addresses the unsafe deserialization behavior.

Proactive Monitoring: Audit data input paths for machine learning models to ensure that only trusted configurations are processed and monitor system calls for unexpected process execution originating from the Keras library.

Compensating Controls: Ensure that all model loading occurs within a SafeModeScope(True) context to enforce safe deserialization practices until a permanent patch is applied.

Public Exploit Available: Unknown

Organizations utilizing Keras for model deployment should verify their current version and update immediately to the latest release. Developers should exercise caution when loading model configurations from external or untrusted sources to prevent exploitation of this deserialization flaw.