Views
No views yet
keras/src/saving/keras_saveable.py
Function: _unpickle_model(), __reduce__()
Type: Remote Code Execution (Insecure Deserialization)KerasSaveable.__reduce__() returns _unpickle_model which calls
_load_model_from_fileobj(safe_mode=False) with no allowlist protection.1class KerasSaveable:
2 def __reduce__(self):
3 return (_unpickle_model, (buffer,))
4
5def _unpickle_model(buffer):
6 return _load_model_from_fileobj(buffer, safe_mode=False) # NO PROTECTIONpickle.load() on a malicious KerasSaveable pickle,
arbitrary code execution occurs through the hardcoded safe_mode=False.1import pickle
2
3with open("malicious_keras_rce.pkl", "rb") as f:
4 result = pickle.load(f) # RCE triggered via __reduce__