A critical deserialization vulnerability in the Keras framework allows an attacker to achieve arbitrary code execution by supplying a malicious model file.

This is a deserialization of untrusted data (CWE-502) vulnerability occurring in the TFSMLayer class. It allows attacker controlled TensorFlow SavedModels to be processed during deserialization, bypassing the intended safe_mode protections and enabling arbitrary code execution under the privileges of the user running the model inference.

The ability for an attacker to execute arbitrary code on a host system presents a severe risk to organizational security. Successful exploitation could lead to full system compromise, unauthorized data exfiltration, or the disruption of critical machine learning pipelines. Given the CVSS score of 8.8, this vulnerability is considered a high-priority threat that requires immediate remediation to prevent potential data breaches or service degradation.

Immediate Action: Update the Keras package to version 3.13.2 or later to apply the necessary validation logic in the from_config method.

Proactive Monitoring: Monitor application logs for unexpected file system access or the loading of untrusted model files, particularly those originating from external or unverified sources.

Compensating Controls: Ensure that any machine learning models are sourced from trusted, internal repositories and implement strict file system permissions to limit the scope of potential code execution.

Public Exploit Available: Unknown.

Organizations utilizing Keras for machine learning tasks must prioritize upgrading to version 3.13.2 immediately. Because this flaw bypasses existing security controls, relying on safe_mode is insufficient for versions prior to the patch. Verify all model ingestion pipelines to ensure that only validated models are processed, and treat all external model files as potentially malicious until the update is deployed.