CVE-2025-61677 json
DataChain: Deserialization of Untrusted Data from Environment Variables
published 2025-10-02 13 mo ago modified 2026-10-08 31 d ago also GHSA-6px8-mr29-cj4r , PYSEC-2026-1288 , EUVD-2025-32652
- cvss
- 2.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.2%
- EPSS 0.2% chance of exploitation in 30 days, percentile 5%
- public exploits
- 0
- none known
Summary
DataChain is a Python-based AI-data warehouse for transforming and analyzing unstructured data. Versions 0.34.1 and below allow for deseriaization of untrusted data because of the way the DataChain library reads serialized objects from environment variables (such as DATACHAIN__METASTORE and DATACHAIN__WAREHOUSE) in the loader.py module. An attacker with the ability to set these environment variables can trigger code execution when the application loads. This issue is fixed in version 0.34.2.
Patch / fix
- pypi datachain 0.34.2
- github.com/iterative/datachain@914b956 commit
- github.com/iterative/datachain#1358 pull request
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 13 mo ago
Exploit prediction
0.17% chance of exploitation in the next 30 days, higher than 5% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 2.5 | CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N |
| OSV | 3.1 | 2.5 | CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N |
| GitHub | 3.1 | 2.5 | CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | datachain | <0.34.2 |
0.34.2 |
Affected products
- iterative datachain
Classification
- Weakness
-
- CWE-502 Deserialization of Untrusted Data
References
-
github.com
/iterative/datachain/pull/1358
web
-
github.com
/iterative/datachain/commit/914b95610620d50c8d9bee506ccbfa7d4d57fdc0
web
-
github.com
/iterative/datachain/security/advisories/GHSA-6px8-mr29-cj4r
web
-
nvd.nist.gov
/vuln/detail/CVE-2025-61677
advisory
-
github.com
/iterative/datachain
package
-
pypi.org
/project/datachain
package
-
github.com
/advisories/GHSA-6px8-mr29-cj4r
advisory
Sources
- CVE List CVE-2025-61677
- GitHub Advisory GHSA-6px8-mr29-cj4r
- NVD CVE-2025-61677
- OSV PYSEC-2026-1288
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.