漏洞信息
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
DataChain: Deserialization of Untrusted Data from Environment Variables
Vulnerability Description
DataChain is a Python-based AI-data warehouse for transforming and analyzing unstructured data. Versions 0.34.1 and below allow for deseriaization of untrusted data because of the way the DataChain library reads serialized objects from environment variables (such as DATACHAIN__METASTORE and DATACHAIN__WAREHOUSE) in the loader.py module. An attacker with the ability to set these environment variables can trigger code execution when the application loads. This issue is fixed in version 0.34.2.
CVSS Information
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
Vulnerability Type
可信数据的反序列化
Vulnerability Title
DataChain 代码问题漏洞
Vulnerability Description
DataChain是Iterative开源的一个版本控制软件。 DataChain 0.34.1及之前版本存在代码问题漏洞，该漏洞源于从环境变量读取序列化对象时未验证数据，可能导致代码执行。
CVSS Information
N/A
Vulnerability Type
N/A