BaseFortify

Publication date: 2025-10-03

Last updated on: 2025-10-06

Assigner: GitHub, Inc.

Description

DataChain is a Python-based AI-data warehouse for transforming and analyzing unstructured data. Versions 0.34.1 and below allow for deseriaization of untrusted data because of the way the DataChain library reads serialized objects from environment variables (such as DATACHAIN__METASTORE and DATACHAIN__WAREHOUSE) in the loader.py module. An attacker with the ability to set these environment variables can trigger code execution when the application loads. This issue is fixed in version 0.34.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-10-03

Last Modified

2025-10-06

Generated

2026-07-06

AI Q&A

2025-10-04

EPSS Evaluated

2026-07-05

NVD

CVE-2025-61677

Affected Vendors & Products

Vendor	Product	Version / Range
iterative	datachain	0.34.2
iterative	datachain	0.34.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-502	The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Attack-Flow Graph

Executive Summary

This vulnerability exists in DataChain versions 0.34.1 and below, where the software deserializes untrusted data from environment variables such as DATACHAIN__METASTORE and DATACHAIN__WAREHOUSE. Because of this, an attacker who can set these environment variables can execute arbitrary code when the application loads. The issue is fixed in version 0.34.2.

Impact Analysis

If an attacker can set environment variables for the DataChain application, they can execute arbitrary code on the system when the application loads. This could lead to unauthorized actions or compromise of the system running DataChain.

Mitigation Strategies

Upgrade DataChain to version 0.34.2 or later, as this version fixes the vulnerability related to deserialization of untrusted data from environment variables. Additionally, avoid setting or allowing untrusted users to set the environment variables DATACHAIN__METASTORE and DATACHAIN__WAREHOUSE to prevent exploitation.

Hi! I’m here to help you understand CVE-2025-61677. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70