Downloads · 30 days
0
keras-rce-poc
Mom3gool2030/keras-rce-poc
keras-rce-poc is a machine learning model from Mom3gool2030. Use it for the machine learning task on the model card, and read the license before you ship it in a product.
Keras KerasSaveable.reduce() and unpicklemodel() in keras/src/saving/kerassaveable.py:22 always pass safemode=False when loading models via pickle. This bypasses Keras's safemode=True protection that was designed to p…
Access
Public
Updated Mar 9, 2026
Repo size
120 B
Likes
0
Public
Repo makeup
Click a slice to open those files.
Other1.5 KB · 57%
At a glance
- Access
- Public
- Created
- Mar 9, 2026
- Updated
- Mar 9, 2026
- SHA
- 4c072efb
Model card
From the Hugging Face model README
Keras — safe_mode=False Bypass via reduce() PoC
Summary
Keras KerasSaveable.__reduce__() and _unpickle_model() in keras/src/saving/keras_saveable.py:22
always pass safe_mode=False when loading models via pickle. This bypasses Keras's safe_mode=True
protection that was designed to prevent arbitrary code execution.
Attack Vector
When Keras models are used with distributed computing frameworks (Ray, Dask, multiprocessing, joblib),
they get pickled via __reduce__(). During unpickling, _unpickle_model() loads the model with
safe_mode=False, allowing arbitrary code execution through lambda layers or custom objects.
Files
malicious_keras_model.pkl— Demonstrates RCE via pickle.load()
Reproduction
import pickle
# Loading a malicious pickled Keras model triggers RCE
with open("malicious_keras_model.pkl", "rb") as f:
model = pickle.load(f) # RCE via safe_mode=False bypass
Affected Version
Keras 3.x (commit d9966a5c09acce4713d68fe1a7cd96713620e211)
- Created
- Mar 9, 2026
- Updated
- Mar 9, 2026