File size: 802 Bytes
40505d1 0c4b502 8dbc1a4 | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 | ---
license: mit
---
# Keras compile_config Lambda RCE PoC
ModelScan bypass via compile_config.loss.__lambda__
## Vulnerability
Keras v3 models can specify a loss function of type `__lambda__`. When loaded with `safe_mode=False`, Keras `eval()`'s the lambda source string, allowing arbitrary code execution.
ModelScan checks for `class_name: "Lambda"` (capital L, referring to the Keras Lambda layer) but does not scan `class_name: "__lambda__"` (referring to the loss function type). This creates a complete bypass.
## Usage
```bash
pip install keras tensorflow
python3 exploit.py
```
## Files
- `evil_model.keras` — Malicious model with __lambda__ loss containing RCE payload
- `exploit.py` — Loader script
## Impact
CVSS 9.8. Supply chain attack via HuggingFace/any model repository.
|