Beveiligingsadvies

CVE-2025-49655

CVE-kwetsbaarheidsdetails - eXtreme Datacenter Security Operations

Gepubliceerd 2025-10-17 15:20:27

Laatst bijgewerkt 2025-10-17 15:58:34

Toegewezen door HiddenLayer

CVSS-score 9.8

Status PUBLISHED

Beschrijving

Deserialization of untrusted data can occur in versions of the Keras framework running versions 3.11.0 up to but not including 3.11.3, enabling a maliciously uploaded Keras file containing a TorchModuleWrapper class to run arbitrary code on an end user’s system when loaded despite safe mode being enabled. The vulnerability can be triggered through both local and remote files.

← Alle CVE's bekijken Bekijk op cve.org ↗