conda vulnerabilities

CVEs per yearBy the year they were published

1. 20256
2. 20264

Newest CVEs

• CVE-2026-53942

  Conda Organization Infrastructure: Pwn Request in update workflow allows PR-controlled template rendering with SYNC_TOKEN

  conda · infrastructure

  Critical9.9
• CVE-2026-53940

  Conda: Entry-point path traversal in noarch:python install (arbitrary file write) — canonical Python implementation

  conda · conda

  High8.8
• CVE-2026-53956

  Rattler vulnerable to package cache path traversal via conda package build string

  conda · rattler_cache

  Medium5.4
• CVE-2026-47425

  Rattler vulnerable to entry-point path traversal in noarch:python install (arbitrary file write)

  conda · rattler

  Medium6.9
• CVE-2025-64343

  (conda) Constructor: Excessive permissions during and after installation

  conda · constructor

  High7.8
• CVE-2025-49823

  Conda Constructor Command Injection via Unsanitized User Input (Low)

  conda · constructor

  None0.0
• CVE-2025-32800

  Conda-build vulnerable to supply chain attack vector due to pyproject.toml referring to dependencies not present in PyPI

  conda · conda-build

  High7.2
• CVE-2025-32799

  Conda-build Vulnerable to Path Traversal via Malicious Tar File

  conda · conda-build

  Medium5.6
• CVE-2025-32798

  Conda-build Allows Arbitrary Code Execution via Malicious Recipe Selectors

  conda · conda-build

  High8.2
• CVE-2025-32797

  Conda-build Insecure Build Script Permissions Enabling Arbitrary Code Execution

  conda · conda-build

  Medium6.0