diff --git a/advisories/github-reviewed/2025/10/GHSA-6px8-mr29-cj4r/GHSA-6px8-mr29-cj4r.json b/advisories/github-reviewed/2025/10/GHSA-6px8-mr29-cj4r/GHSA-6px8-mr29-cj4r.json index b002cfe9a2601..4b7d2cfa6e4f6 100644 --- a/advisories/github-reviewed/2025/10/GHSA-6px8-mr29-cj4r/GHSA-6px8-mr29-cj4r.json +++ b/advisories/github-reviewed/2025/10/GHSA-6px8-mr29-cj4r/GHSA-6px8-mr29-cj4r.json @@ -1,13 +1,13 @@ { "schema_version": "1.4.0", "id": "GHSA-6px8-mr29-cj4r", - "modified": "2025-10-02T16:24:46Z", + "modified": "2025-10-02T16:24:50Z", "published": "2025-10-02T16:24:46Z", "aliases": [ "CVE-2025-61677" ], - "summary": "DataChain Vulnerable to Deserialization of Untrusted Data from Environment Variables", - "details": "The DataChain library reads serialized objects from environment variables (such as `DATACHAIN__METASTORE` and `DATACHAIN__WAREHOUSE`) in the `loader.py` module. An attacker with the ability to set these environment variables can trigger code execution when the application loads.", + "summary": "Add contributor credit for discovery and reporting of deserialization vulnerability in DataChain", + "details": "This pull request adds contributor credit for the discovery, verification, and reporting of a deserialization vulnerability in the DataChain library. The vulnerability occurs in loader.py where serialized objects are read from environment variables (DATACHAIN__METASTORE and DATACHAIN__WAREHOUSE), allowing an attacker with control over these variables to execute arbitrary code.\n\nCWE Classification:", "severity": [ { "type": "CVSS_V3",