EUVD-2022-15808

Malicious code in bioql PyPI...

EUVD-2024-1181

Malicious code in bioql PyPI...

EUVD-2023-42096

Malicious code in bioql PyPI...

EUVD-2022-35620

Malicious code in bioql PyPI...

EUVD-2023-45182

Malicious code in bioql PyPI...

EUVD-2023-38103

Malicious code in bioql PyPI...

EUVD-2022-44892

Malicious code in bioql PyPI...

EUVD-2022-2644

Malicious code in bioql PyPI...

EUVD-2025-9010

Malicious code in bioql PyPI...

EUVD-2022-7411

Malicious code in bioql PyPI...

EUVD-2025-28697

Malicious code in bioql PyPI...

EUVD-2023-1669

Malicious code in bioql PyPI...

EUVD-2025-16913

Malicious code in bioql PyPI...

EUVD-2012-0857

Malicious code in bioql PyPI...

DataChain 代码问题漏洞

DataChain is a version control software from Iterative open source. A code issue vulnerability exists in DataChain 0.34.1 and prior versions, which stems from failure to validate data when reading serialized objects from environment variables, which could lead to code execution...

CVE-2025-59952

MinIO Java SDK is a Simple Storage Service aka S3 client to perform bucket and object operations to any Amazon S3 compatible object storage service. In minio-java versions prior to 8.6.0, XML tag values containing references to system properties or environment variables were automatically...

Deserialization of Untrusted Data

Overview datachain is a Wrangle unstructured AI data at scale Affected versions of this package are vulnerable to Deserialization of Untrusted Data via the loader.py module. An attacker can execute arbitrary code by setting crafted environment variables that are deserialized by the application...

DataChain Vulnerable to Deserialization of Untrusted Data from Environment Variables

The DataChain library reads serialized objects from environment variables such as DATACHAINMETASTORE and DATACHAINWAREHOUSE in the loader.py module. An attacker with the ability to set these environment variables can trigger code execution when the application loads...

GHSA-6PX8-MR29-CJ4R DataChain Vulnerable to Deserialization of Untrusted Data from Environment Variables

The DataChain library reads serialized objects from environment variables such as DATACHAINMETASTORE and DATACHAINWAREHOUSE in the loader.py module. An attacker with the ability to set these environment variables can trigger code execution when the application loads...

In Sudo before 1.9.12p2, the sudoedit (aka -e) feature mishandles extra arguments passed in the user-provided environment variables (SUDO_EDITOR, VISUAL, and EDITOR), allowing a local attacker to append arbitrary entries to the list of files to process. This can lead to privilege escalation. Affected versions are 1.8.0 through 1.9.12.p1. The problem exists because a user-specified editor may contain a "--" argument that defeats a protection mechanism, e.g., an EDITOR='vim -- /path/to/extra/file' value.

...