iterative/datachain · Security
DataChain Vulnerable to Deserialization of Untrusted Data from Environment Variables
- GHSA ID
- GHSA-6px8-mr29-cj4r
- CVE ID
- CVE-2025-61677
- Severity
- low
- Published
- Updated
- CVSS
- 2.5 · CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
- CVSS v3
- 2.5 · CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
Description
The DataChain library reads serialized objects from environment variables (such as DATACHAIN__METASTORE and DATACHAIN__WAREHOUSE) in the loader.py module. An attacker with the ability to set these environment variables can trigger code execution when the application loads.
CWEs
- CWE-502 · Deserialization of Untrusted Data
References
- https://github.com/iterative/datachain/security/advisories/GHSA-6px8-mr29-cj4r ↗
- https://github.com/iterative/datachain/pull/1358 ↗
- https://github.com/iterative/datachain/commit/914b95610620d50c8d9bee506ccbfa7d4d57fdc0 ↗
- https://nvd.nist.gov/vuln/detail/CVE-2025-61677 ↗
- https://github.com/advisories/GHSA-6px8-mr29-cj4r ↗