CVE-2025-1550
CRITICAL NUCLEIKeras 3.0.0-3.8.0 and 3.9.0 - Remote Code Execution via Malicious .keras Archive
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2025-1550. PoCs published by Mohammed Idrees Banyamer, ChCh0i. A Nuclei detection template is also available.
AI-analyzed exploit summary This exploit leverages insecure deserialization in Keras model loading to achieve remote code execution by embedding a malicious Lambda layer in a crafted .keras file. When the victim loads the model, the embedded `os.system` call executes arbitrary commands.
Description
The Keras Model.load_model function permits arbitrary code execution, even with safe_mode=True, through a manually constructed, malicious .keras archive. By altering the config.json file within the archive, an attacker can specify arbitrary Python modules and functions, along with their arguments, to be loaded and executed during model loading.
Exploits (2)
This exploit leverages insecure deserialization in Keras model loading to achieve remote code execution by embedding a malicious Lambda layer in a crafted .keras file. When the victim loads the model, the embedded `os.system` call executes arbitrary commands.
This repository contains a functional exploit for CVE-2025-1550, demonstrating RCE via malicious Keras model JSON configuration. The exploit manipulates the model's config.json to include a subprocess.Popen call, bypassing validation checks.
Nuclei Templates (1)
References (2)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H