Keras versions 3.11.0 through 3.11.2 are vulnerable to deserialization of untrusted data, allowing arbitrary code execution when loading maliciously crafted Keras files containing a TorchModuleWrapper class. This vulnerability can be triggered via both local and remote files, bypassing safe mode protections. The issue is fixed in version 3.11.3.