Deserialization of untrusted data can occur in versions of the Keras framework running versions 3.11.0 up to but not including 3.11.3, enabling a maliciously uploaded Keras file co

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

• PyPI keras3.11.0 → 3.11.3
• vendor Keras keras 3.11.0 <3.11.33.11.0 <3.11.3

How to fix CVE-2025-49655

• Upgrade

  CVE-2025-49655 lists a fix boundary at 3.11.3. Compare the installed build with that boundary before you change production.

• Version check

  Seen in 3.11.0 → 3.11.3 · 1 other packages on the advisory

• Advisory

  Open the cve_org record and follow its fix.

• Official advisories

  • CVE.org · cve.org
  • FIRST EPSS · first.org
  • EUVD · euvd.enisa.europa.eu
  • PyPA Advisory Database · osv.dev

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Code

The project this record applies to. Exploit listings stay in References.

• Repository · github.com
• Repository · github.com
• keras · pypi.org

Timeline

Detection, updates, and resolution for this record.

1. Oct 17, 2025 · EUVD

   Detected

   Deserialization of untrusted data can occur in versions of the Keras framework running versions 3.11.0 up to but not including 3.11.3, enabling a maliciously uploaded Keras file containing a TorchModuleWrapper class to run arbitrary code on an end user’s system when loaded despite safe mode being enabled. The vulnerability can be triggered through both local and remote files.

2. Oct 17, 2025 · EUVD

   Updated

   Deserialization of untrusted data can occur in versions of the Keras framework running versions 3.11.0 up to but not including 3.11.3, enabling a maliciously uploaded Keras file containing a TorchModuleWrapper class to run arbitrary code on an end user’s system when loaded despite safe mode being enabled. The vulnerability can be triggered through both local and remote files.

3. Oct 27, 2026 · PyPA Advisory Database

   Fix available

   keras fixed in 3.11.3

4. Oct 27, 2026 · PyPA Advisory Database

   Fix available

   keras fixed in 3.11.3

5. Oct 27, 2026 · PyPA Advisory Database

   Updated

   Deserialization of untrusted data can occur in versions of the Keras framework running versions 3.11.0 up to but not including 3.11.3, enabling a maliciously uploaded Keras file containing a TorchModuleWrapper class to run arbitrary code on an end user’s system when loaded despite safe mode being enabled. The vulnerability can be triggered through both local and remote files.

Sources

• CVE.orgVulnerability recordCVE-2025-49655

  Official CVE identifier

  cve.org
• FIRST EPSSExploitation probabilityCVE-2025-49655

  30-day exploitation probability 0.75%

  first.org
• EUVDVulnerability recordEUVD-2025-34892

  Deserialization of untrusted data can occur in versions of the Keras framework running versions 3.11.0 up to but not including 3.11.3, enabling a maliciously uploaded Keras file containing a TorchModuleWrapper class to run arbitrary code on an end user’s system when loaded despit

  euvd.enisa.europa.eu
• PyPA Advisory DatabasePackage advisoryGHSA-cvhh-q5g5-qprp

  Keras framework vulnerable to deserialization of untrusted data

  osv.dev

References

• EUVD record · euvd.enisa.europa.eu
• PACKAGE · github.com
• EUVD reference · github.com
• WEB · github.com
• WEB · hiddenlayer.com
• EUVD reference · hiddenlayer.com
• ADVISORY · nvd.nist.gov
• WEB · pypi.org

Freshness

Last verified in this catalog Oct 26, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.

• PyPA Advisory DatabaseOct 27, 2026
• FIRST EPSSOct 26, 2026
• CVE.orgOct 26, 2026
• EUVDOct 26, 2026