~ / search / GHSA-6px8-mr29-cj4r

GHSA-6px8-mr29-cj4r

DataChain Vulnerable to Deserialization of Untrusted Data from Environment Variables

Source: GitHub Advisory Database (reviewed) Low CVE-2025-61677

Packages

EcosystemPackageAffectedFixed in
PyPI datachain < 0.34.2 0.34.2

Details

As written in the advisory (Markdown source, shown as plain text).

The DataChain library reads serialized objects from environment variables (such as `DATACHAIN__METASTORE` and `DATACHAIN__WAREHOUSE`) in the `loader.py` module. An attacker with the ability to set these environment variables can trigger code execution when the application loads.

References

External links from the advisory. They lead to third-party sites.