CVE-2025-49655 – Keras TorchModuleWrapper Deserialization Vulnerability

CVE ID : CVE-2025-49655

Published : Oct. 17, 2025, 4:15 p.m. | 25 minutes ago

Description : Deserialization of untrusted data can occur in versions of the Keras framework running versions 3.11.0 up to but not including 3.11.3, enabling a maliciously uploaded Keras file containing a TorchModuleWrapper class to run arbitrary code on an end user’s system when loaded despite safe mode being enabled. The vulnerability can be triggered through both local and remote files.

Severity: 9.8 | CRITICAL

Visit the link for more details, such as CVSS details, affected products, timeline, and more…