GHSA-6px8-mr29-cj4rLowCVSS 2.5
DataChain Vulnerable to Deserialization of Untrusted Data from Environment Variables
🔗 CVE IDs covered (1)
📋 Description
The DataChain library reads serialized objects from environment variables (such as DATACHAIN__METASTORE and DATACHAIN__WAREHOUSE) in the loader.py module. An attacker with the ability to set these environment variables can trigger code execution when the application loads.
🎯 Affected products1
- pip/datachain:< 0.34.2
🔗 References (5)
- https://github.com/iterative/datachain/security/advisories/GHSA-6px8-mr29-cj4r
- https://github.com/iterative/datachain/pull/1358
- https://github.com/iterative/datachain/commit/914b95610620d50c8d9bee506ccbfa7d4d57fdc0
- https://nvd.nist.gov/vuln/detail/CVE-2025-61677
- https://github.com/advisories/GHSA-6px8-mr29-cj4r