Read the docs
TI-2025-38109 Aliases CVE-2025-61677GHSA-6px8-mr29-cj4r

DataChain: Deserialization of Untrusted Data from Environment Variables

Priority LOW 12CWE-502Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
High
Impact type
Code execution
Confidentiality · integrity · availability
None · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-502.

Summary

DataChain is a Python-based AI-data warehouse for transforming and analyzing unstructured data. Versions 0.34.1 and below allow for deseriaization of untrusted data because of the way the DataChain library reads serialized objects from environment variables (such as DATACHAIN__METASTORE and DATACHAIN__WAREHOUSE) in the loader.py module. An attacker with the ability to set these environment variables can trigger code execution when the application loads. This issue is fixed in version 0.34.2.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00166 5th percentileScored 2026-11-07
Fix Fixed datachain (iterative): 0.34.2datachain (PyPI): 0.34.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
iterativedatachainbefore 0.34.20.34.2Patch availableCNA
—datachain (PyPI)before 0.34.20.34.2Patch availableGHSA-6px8-mr29-cj4r
  • datachain Vendoriterative Affected before 0.34.2 Fixed in 0.34.2 Patch available CNA
  • datachain (PyPI) Vendor— Affected before 0.34.2 Fixed in 0.34.2 Patch available GHSA-6px8-mr29-cj4r

Remediation

  • Fix · CNA datachain (iterative) Fixed in 0.34.2
  • Fix · GHSA-6px8-mr29-cj4r datachain (PyPI) Fixed in 0.34.2 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-61677
  2. 2026-10-03 Alias added: GHSA-6px8-mr29-cj4r

References

Advisory 1

Other 4

  • TI-2023-26933 Unsafe YAML deserialization in PyDrive2 CVSS 3.1HIGH 7.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences