iterative datachain up to 0.34.1 Environment Variable loader.py DATACHAIN__METASTORE/DATACHAIN__WAREHOUSE deserialization

Summaryinfo

A vulnerability, which was classified as problematic, has been found in iterative datachain up to 0.34.1. Affected is an unknown function of the file loader.py of the component Environment Variable Handler. Performing a manipulation of the argument DATACHAIN__METASTORE/DATACHAIN__WAREHOUSE results in deserialization. This vulnerability is known as CVE-2025-61677. Attacking locally is a requirement. No exploit is available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability was found in iterative datachain up to 0.34.1. It has been classified as problematic. This affects an unknown functionality of the file loader.py of the component Environment Variable Handler. The manipulation of the argument DATACHAIN__METASTORE/DATACHAIN__WAREHOUSE with an unknown input leads to a deserialization vulnerability. CWE is classifying the issue as CWE-502. The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid. This is going to have an impact on integrity. The summary by CVE is:

DataChain is a Python-based AI-data warehouse for transforming and analyzing unstructured data. Versions 0.34.1 and below allow for deseriaization of untrusted data because of the way the DataChain library reads serialized objects from environment variables (such as DATACHAIN__METASTORE and DATACHAIN__WAREHOUSE) in the loader.py module. An attacker with the ability to set these environment variables can trigger code execution when the application loads. This issue is fixed in version 0.34.2.

The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2025-61677 since 09/29/2025. The exploitability is told to be difficult. An attack has to be approached locally. Technical details are known, but no exploit is available.

Upgrading to version 0.34.2 eliminates this vulnerability. Applying the patch 914b95610620d50c8d9bee506ccbfa7d4d57fdc0 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• iterative

Name

• datachain

Version

• 0.34.0
• 0.34.1

License

• open-source

Website

• Product: https://github.com/iterative/datachain/

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion