The Keras Model.load_model method can be exploited to achieve arbitrary code execution, even with safe_mode=True. One can create a specially crafted .h5/.hdf5 model archive that, when loaded via Model.load_model, will trigger arbitrary code to be executed. This is achieved by crafting a special .h5 archive file that uses the Lambda layer feature of keras which allows arbitrary Python code in the form of pickled code. The vulnerability comes from the fact that the safe_mode=True option is not honored when reading .h5 archives. Note that the .h5/.hdf5 format is a legacy format supported by Keras 3 for backwards compatibility.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - The Keras Model.load_model method can be exploited to achieve arbitrary code execution, even with
    safe_mode=True. One can create a specially crafted .h5/.hdf5 model archive that, when loaded via
    Model.load_model, will trigger arbitrary code to be executed. This is achieved by crafting a special .h5
    archive file that uses the Lambda layer feature of keras which allows arbitrary Python code in the form of
    pickled code. The vulnerability comes from the fact that the safe_mode=True option is not honored when
    reading .h5 archives. Note that the .h5/.hdf5 format is a legacy format supported by Keras 3 for backwards
    compatibility. (CVE-2025-9905)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The Keras Model.load_model method can be exploited to achieve arbitrary code execution, even with     safe_mode=True. One can create a specially crafted .h5/.hdf5 model archive that, when loaded via     Model.load_model, will trigger arbitrary code to be executed. This is achieved by crafting a special .h5     archive file that uses the Lambda layer feature of keras which allows arbitrary Python code in the form of     pickled code. The vulnerability comes from the fact that the safe_mode=True option is not honored when     reading .h5 archives. Note that the .h5/.hdf5 format is a legacy format supported by Keras 3 for backwards     compatibility. (CVE-2025-9905)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
442728	SCA: security update for keras (GHSA-36rr-ww3j-vrjv)	Tenable Cloud Security	SCA Checks	Local	high
442728	SCA: security update for keras (GHSA-36rr-ww3j-vrjv)	Tenable Self-Hosted Container Security	SCA Checks	Local	high
265855	Linux Distros Unpatched Vulnerability : CVE-2025-9905	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2025-9905

high

Tenable Plugins

high

high

high