| license: mit | |
| # Keras compile_config Lambda RCE PoC | |
| ModelScan bypass via compile_config.loss.__lambda__ | |
| ## Vulnerability | |
| Keras v3 models can specify a loss function of type `__lambda__`. When loaded with `safe_mode=False`, Keras `eval()`'s the lambda source string, allowing arbitrary code execution. | |
| ModelScan checks for `class_name: "Lambda"` (capital L, referring to the Keras Lambda layer) but does not scan `class_name: "__lambda__"` (referring to the loss function type). This creates a complete bypass. | |
| ## Usage | |
| ```bash | |
| pip install keras tensorflow | |
| python3 exploit.py | |
| ``` | |
| ## Files | |
| - `evil_model.keras` — Malicious model with __lambda__ loss containing RCE payload | |
| - `exploit.py` — Loader script | |
| ## Impact | |
| CVSS 9.8. Supply chain attack via HuggingFace/any model repository. | |