Vulnerability Instance

HTTP 200 OK
Allow: GET, HEAD, OPTIONS
Content-Type: application/json
Vary: Accept

{
    "url": "http://public2.vulnerablecode.io/api/vulnerabilities/47819?format=api",
    "vulnerability_id": "VCID-cmug-fp72-8qc4",
    "summary": "Duplicate Advisory: The Keras `Model.load_model` method **silently** ignores `safe_mode=True` and allows arbitrary code execution when a `.h5`/`.hdf5` file is loaded.\n### Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-36rr-ww3j-vrjv. This link is maintained to preserve external references.\n\n### Original Description\nThe Keras Model.load_model method can be exploited to achieve arbitrary code execution, even with safe_mode=True.\n\nOne can create a specially crafted .h5/.hdf5 model archive that, when loaded via Model.load_model, will trigger arbitrary code to be executed.\n\nThis is achieved by crafting a special .h5 archive file that uses the Lambda layer feature of keras which allows arbitrary Python code in the form of pickled code. The vulnerability comes from the fact that the safe_mode=True option is not honored when reading .h5 archives.\n\nNote that the .h5/.hdf5 format is a legacy format supported by Keras 3 for backwards compatibility.",
    "aliases": [
        {
            "alias": "GHSA-77wq-646f-jrm2"
        }
    ],
    "fixed_packages": [
        {
            "url": "http://public2.vulnerablecode.io/api/packages/46360?format=api",
            "purl": "pkg:pypi/keras@3.11.3",
            "is_vulnerable": true,
            "affected_by_vulnerabilities": [
                {
                    "vulnerability": "VCID-1xj9-1kng-8ua4"
                }
            ],
            "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/keras@3.11.3"
        }
    ],
    "affected_packages": [
        {
            "url": "http://public2.vulnerablecode.io/api/packages/44613?format=api",
            "purl": "pkg:pypi/keras@3.0.0",
            "is_vulnerable": true,
            "affected_by_vulnerabilities": [
                {
                    "vulnerability": "VCID-1xj9-1kng-8ua4"
                },
                {
                    "vulnerability": "VCID-cmug-fp72-8qc4"
                },
                {
                    "vulnerability": "VCID-dy5p-938j-d7fr"
                },
                {
                    "vulnerability": "VCID-gu8d-jjtb-zuau"
                },
                {
                    "vulnerability": "VCID-ptyp-n4df-aqf1"
                },
                {
                    "vulnerability": "VCID-zsjb-zbnj-z3d8"
                }
            ],
            "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/keras@3.0.0"
        }
    ],
    "references": [
        {
            "reference_url": "https://github.com/keras-team/keras",
            "reference_id": "",
            "reference_type": "",
            "scores": [],
            "url": "https://github.com/keras-team/keras"
        },
        {
            "reference_url": "https://github.com/keras-team/keras/pull/21602",
            "reference_id": "",
            "reference_type": "",
            "scores": [],
            "url": "https://github.com/keras-team/keras/pull/21602"
        },
        {
            "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2025-9905",
            "reference_id": "CVE-2025-9905",
            "reference_type": "",
            "scores": [],
            "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-9905"
        },
        {
            "reference_url": "https://github.com/advisories/GHSA-77wq-646f-jrm2",
            "reference_id": "GHSA-77wq-646f-jrm2",
            "reference_type": "",
            "scores": [],
            "url": "https://github.com/advisories/GHSA-77wq-646f-jrm2"
        }
    ],
    "weaknesses": [
        {
            "cwe_id": 913,
            "name": "Improper Control of Dynamically-Managed Code Resources",
            "description": "The product does not properly restrict reading from or writing to dynamically-managed code resources such as variables, objects, classes, attributes, functions, or executable instructions or statements."
        },
        {
            "cwe_id": 937,
            "name": "OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities",
            "description": "Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2013."
        },
        {
            "cwe_id": 1035,
            "name": "OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities",
            "description": "Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2017."
        }
    ],
    "exploits": [],
    "severity_range_score": null,
    "exploitability": null,
    "weighted_severity": null,
    "risk_score": null,
    "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-cmug-fp72-8qc4"
}