dvc-data dependency python-diskcache has critical vulnerability

[jeremyherr]

Sorry, this is not really a bug report or a feature request.

My team has built our data pipeline using DVC. I have been informed that python-diskcache, which is a dependency of dvc-data, has a critical vulnerability which causes its CVSS score to be > 9, which means it will be blocked by our company's InfoSec team, so that we can not download it, and therefore can not build our data pipeline.

This is the vulnerability that is causing diskcache to have a high CVSS score: https://nvd.nist.gov/vuln/detail/CVE-2025-69872

The python-diskcache PR (grantjenks/python-diskcache#364), which appears to address the vulnerability, would introduce breaking changes (and has version 6.0.0). However, my team has tested it locally and our dvc repro commands work fine with it.

There is no recent activity in the python-diskcache repo and the maintainer has not been responding for a few months, so I don't know when this fix will be merged. The fix is also available in the following fork: https://github.com/mapped/python-diskcache

@skshetry

[skshetry]

Based on my reading of the issue, the diskcache vulnerability does not directly affect us because we explicitly configure the cache directory.

However, our setup has a similar risk on Linux because we write the cache to /var/tmp, which is considered insecure, and is world-writable:

• site_cache_dir: Use /var/cache again instead of /var/tmp on UNIX tox-dev/platformdirs#239

dvc/dvc/repo/__init__.py

Line 633 in f74c1c0

os.makedirs(repos_dir, mode=0o777, exist_ok=True)

The original intention was to allow multiple users on the same machine to reuse the shared cache.

Other platforms are not affected.

[rehan243]

Oh yeah, I ran into something similar with a dependency getting flagged by InfoSec. It's a nightmare when upstream maintainers go quiet. For this, if your team tested the fork and it works with dvc repro, you could temporarily pin dvc-data to use the forked version of python-diskcache. I've done this before to unblock pipelines while waiting for an official release.

You can override the dependency in your requirements.txt like this:

dvc-data
git+https://github.com/mapped/python-diskcache.git@main#egg=diskcache

Or if you're using pip-tools, add this to your requirements.in and regenerate the lockfile. Just be aware you'll need to keep an eye on the fork for any updates, since it's not the official repo.

Also, if this breaks down the road due to deeper integration with dvc-data, you might need to patch dvc-data itself to fully support DiskCache 6.0.0. Hopefully, though, the DVC team can chime in with a plan here.