Keras-Team Keras Unsafe Deserialization Vulnerability in TorchModuleWrapper

A vulnerability exists in Keras-Team Keras version 3.15.0, allowing unsafe deserialization of attacker-controlled PyTorch pickle data through the public `TorchModuleWrapper.from_config` method. This method calls `torch.load(..., weights_only=False)` without requiring an explicit unsafe opt-in, such as `safe_mode=False`. When not within a `SafeModeScope(True)` context, the lack of an ambient safe mode state defaults to allowing unsafe deserialization. This vulnerability could lead to arbitrary code execution if untrusted Keras layer configurations are processed with this method.

Impact

Exploitation of this vulnerability can result in arbitrary code execution through unsafe deserialization of PyTorch objects via Keras layer configurations.

Reproduction

The vulnerability can be reproduced by calling `TorchModuleWrapper.from_config()` with a Keras configuration that includes a base64-encoded PyTorch module payload. This should be done outside of a `SafeModeScope(True)` context, which would block the operation. The deserialization process can be verified by checking for the creation of a marker file, indicating that the payload was executed.

Remediation

To address this vulnerability, the `from_config` method should be modified to include an explicit `safe_mode` parameter, defaulting to blocking unsafe deserialization unless `safe_mode=False` is explicitly provided. Additionally, Keras documentation should be updated to warn that serialized PyTorch modules from untrusted sources are unsafe.