xiaoyaoes/keras-compile-config-lambda-rce

Keras compile_config Lambda RCE PoC

ModelScan bypass via compileconfig.loss.lambda_

Vulnerability

Keras v3 models can specify a loss function of type __lambda__. When loaded with safe_mode=False, Keras eval()'s the lambda source string, allowing arbitrary code execution.

ModelScan checks for class_name: "Lambda" (capital L, referring to the Keras Lambda layer) but does not scan class_name: "__lambda__" (referring to the loss function type). This creates a complete bypass.

Usage

pip install keras tensorflow
python3 exploit.py

Files

• —evil_model.keras — Malicious model with _lambda_ loss containing RCE payload
• —exploit.py — Loader script

Impact

CVSS 9.8. Supply chain attack via HuggingFace/any model repository.