PyPI: datahub

CVE-2023-25560

Safety vulnerability ID: SFTY-20230211-86861

Safety legacy ID: pyup.io-63335

DataHub's AuthServiceClient, specifically versions prior to 0.8.45, creates JSON strings using format strings containing user-controlled data. This method enables potential attackers to manipulate these JSON strings and forward them to the backend, leading to potential misuse and authentication bypasses. Such misuse could result in the generation of system accounts, potentially leading to full system compromise. This vulnerability was identified and reported by the GitHub Security lab and is being tracked under GHSL-2022-080. https://github.com/datahub-project/datahub/security/advisories/GHSA-6rpf-5cfg-h8f3

PythonPyPINVDNVD
Created at: Jul 5, 2026Updated at: Jul 5, 2026

Overview

DataHub's AuthServiceClient, specifically versions prior to 0.8.45, creates JSON strings using format strings containing user-controlled data. This method enables potential attackers to manipulate these JSON strings and forward them to the backend, leading to potential misuse and authentication bypasses. Such misuse could result in the generation of system accounts, potentially leading to full system compromise. This vulnerability was identified and reported by the GitHub Security lab and is being tracked under GHSL-2022-080. https://github.com/datahub-project/datahub/security/advisories/GHSA-6rpf-5cfg-h8f3

Advisory

DataHub's AuthServiceClient, specifically versions prior to 0.8.45, creates JSON strings using format strings containing user-controlled data. This method enables potential attackers to manipulate these JSON strings and forward them to the backend, leading to potential misuse and authentication bypasses. Such misuse could result in the generation of system accounts, potentially leading to full system compromise. This vulnerability was identified and reported by the GitHub Security lab and is being tracked under GHSL-2022-080. https://github.com/datahub-project/datahub/security/advisories/GHSA-6rpf-5cfg-h8f3

Affected Package

Affecting datahub package, versions<0.8.45

Also affects

---

How to Fix

Upgradedatahubto0.8.89.dev0or higher.

Mitigation and Workarounds

---

Vulnerable Functions

Functions linked to known vulnerabilities.

Vulnerable function data is available for Enterprise customers

Book a call with us to see Safety in action.

References

Safety

Verified by Safety

Our Cybersecurity Intelligence Team reviewed this vulnerability. We combine public data with our own research to find issues not yet reported to public sources.

Learn more