[GHSA-6px8-mr29-cj4r] DataChain Vulnerable to Deserialization of Untrusted Data from Environment Variables

[asimhusain-ai]

Updates

• Description
• Summary

Comments
Discovered that DataChain deserializes untrusted objects from environment variables (DATACHAIN__METASTORE and DATACHAIN__WAREHOUSE) in loader.py, leading to potential remote code execution. Verified and reported the issue via PR #1358 and commit 914b956. This update ensures accurate contributor attribution and proper classification under CWE-502.

[github]

Hi there @shcheklein! A community member has suggested an improvement to your security advisory. If approved, this change will affect the global advisory listed at github.com/advisories. It will not affect the version listed in your project repository.

This change will be reviewed by our Security Curation Team. If you have thoughts or feedback, please share them in a comment here! If this PR has already been closed, you can start a new community contribution for this advisory

[Copilot]

Pull Request Overview

This PR updates a GitHub Security Advisory (GHSA-6px8-mr29-cj4r) to add proper contributor attribution for the discovery and reporting of a deserialization vulnerability in the DataChain library. The changes focus on updating the advisory's summary and description to reflect contributor credit rather than just describing the vulnerability itself.

• Updated the advisory summary to focus on contributor credit attribution
• Enhanced the details section to include contributor acknowledgment and CWE classification
• Updated the modification timestamp to reflect these changes

---

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

[shelbyc]

Hi @asimhusain-ai, I'm closing the PR because the changes to the advisory summary and description mention adding credit but don't improve the overall informational value of the advisory. If you need to have a conversation about researcher or reporter credit, you will need to talk to the maintainer privately.