CVE-2025-61677CWE-502insecure-deserialization

CVE-2025-61677

Low · published October 4, 2025

CVSS v3.1
2.5
EPSS
0%
Percentile
5.1
In the wild
Unconfirmed
What it is

DataChain is a Python-based AI-data warehouse for transforming and analyzing unstructured data. Versions 0.34.1 and below allow for deseriaization of untrusted data because of the way the DataChain library reads serialized objects from environment variables (such as DATACHAIN__METASTORE and DATACHAIN__WAREHOUSE) in the loader.py module. An attacker with the ability to set these environment variables can trigger code execution when the application loads. This issue is fixed in version 0.34.2.

The record
Technical detail
CVSS v3.1
2.5 · LOW
Vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00162 · 5.1th percentile
Weakness
CWE-502 · Deserialization of Untrusted Data
Published
2025-10-04T02:15Z
References (3)
https://github.com/iterative/datachain/commit/914b95610620d50c8d9bee506ccbfa7d4d57fdc0 · [email protected]https://github.com/iterative/datachain/pull/1358 · [email protected]https://github.com/iterative/datachain/security/advisories/GHSA-6px8-mr29-cj4r · [email protected]
EPSS history
Timeline
  • 03 OCT 21:18Z
    DataChain: Deserialization of Untrusted Data from Environment Variables
    cvelistv5