GitHub Advisoryadvisory · PyPI
GHSA-6px8-mr29-cj4r DataChain Vulnerable to Deserialization of Untrusted Data from Environment Variables
LOW
Official page ↗
- Aliases
- CVE-2025-61677
- Ecosystem
- PyPI
- Packages
- datachain
- Severity
- Low
- CVSS vector
- CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
- Weaknesses
- CWE-502
- Reviewed
- 2025-10-02
Affected packages
• PyPI datachain: < 0.34.2 → fixed in 0.34.2
Description
The DataChain library reads serialized objects from environment variables (such as `DATACHAIN__METASTORE` and `DATACHAIN__WAREHOUSE`) in the `loader.py` module. An attacker with the ability to set these environment variables can trigger code execution when the application loads.
Related
Alias · CVE (1)
- CVE-2025-61677 DataChain is a Python-based AI-data warehouse for transforming and analyzing unstructured data. vulnerability
Weakness · CWE (1)
- CWE-502 Deserialization of Untrusted Data weakness
References
- https://github.com/iterative/datachain/security/advisories/GHSA-6px8-mr29-cj4r web
- https://nvd.nist.gov/vuln/detail/CVE-2025-61677 advisory
- https://github.com/iterative/datachain/pull/1358 web
- https://github.com/iterative/datachain/commit/914b95610620d50c8d9bee506ccbfa7d4d57fdc0 web
- https://github.com/iterative/datachain package