PT-2025-40450 · Datachain · Datachain

Shcheklein · Published 2025-10-02 · Updated 2025-10-27 · CVE-2025-61677

Positive Technologies (AI Summary)

CVSS v3.1

2.5

Low

Base vector

AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions DataChain versions 0.34.1 and below

Description DataChain is a Python-based AI-data warehouse for transforming and analyzing unstructured data. The library reads serialized objects from environment variables, specifically DATACHAIN METASTORE and DATACHAIN WAREHOUSE, within the loader.py module. This process allows for deserialization of untrusted data. An attacker who can set these environment variables can trigger code execution when the application loads.

Recommendations Update to version 0.34.2 or later.

Exploit

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2025-61677

GHSA-6PX8-MR29-CJ4R

ZDI-25-965

Affected Products

Datachain

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/61xxx/CVE-2025-61677.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-61677 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-25-965 · Security Note
• https://osv.dev/vulnerability/CVE-2025-61677 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-6px8-mr29-cj4r · Vendor Advisory
• https://github.com/iterative/datachain/pull/1358 · Note
• https://github.com/iterative/datachain · Note
• https://github.com/iterative/datachain/commit/914b95610620d50c8d9bee506ccbfa7d4d57fdc0 · Note
• https://github.com/iterative/datachain/security/advisories/GHSA-6px8-mr29-cj4r · Note
• https://t.me/CVEtracker/34065 · Telegram Post
• https://twitter.com/CVEnew/status/1974227109678551539 · Twitter Post
• https://t.me/cveNotify/137375 · Telegram Post