low2.5
CVE-2025-61677
DataChain Vulnerable to Deserialization of Untrusted Data from Environment Variables
Impact
The DataChain library reads serialized objects from environment variables (such as `DATACHAIN__METASTORE` and `DATACHAIN__WAREHOUSE`) in the `loader.py` module. An attacker with the ability to set these environment variables can trigger code execution when the application loads.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| pip | datachain | < 0.34.2 | 0.34.2 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/iterative/datachain/commit/914b95610620d50c8d9bee506ccbfa7d4d57fdc0
- https://github.com/iterative/datachain/pull/1358
- https://github.com/iterative/datachain/security/advisories/GHSA-6px8-mr29-cj4r
- https://github.com/advisories/GHSA-6px8-mr29-cj4r
- https://nvd.nist.gov/vuln/detail/CVE-2025-61677