Vulnerability: safe_mode=True in keras.saving.load_model() only blocks 7 specific API names. 739/744 registered Keras functions bypass this check and can be injected into model configs.
Impact: SSRF, state corruption, DoS via crafted .keras model files.
Files:
poc.py — Full proof-of-concept with all attack variants
ssrf_mnist_load_data.keras — .keras model with keras.datasets.mnist.load_data as activation (SSRF)… See the full description on the dataset page:
https://huggingface.co/datasets/Rammadaeus/keras-func-injection-poc.
