VulnerabilityAnalyzed

CVE-2025-32800

An attacker could claim this namespace and upload arbitrary (malicious) code to the package, and then exploit pip install commands by injecting the malicious dependency in the solve.

HIGH 7.2EPSS 0.60%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.60%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

Conda-build contains commands and tools to build conda packages. Prior to version 25.3.0, the pyproject.toml lists conda-index as a Python dependency. This package is not published in PyPI. An attacker could claim this namespace and upload arbitrary (malicious) code to the package, and then exploit pip install commands by injecting the malicious dependency in the solve. This issue has been fixed in version 25.3.0. A workaround involves using --no-deps for pip install-ing the project from the repository.

CVSS 4.0: 7.2 HIGHCVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 0.60% probability · 47th percentile
CISA KEV: Not listed
Weakness: CWE-1357
Affected: anaconda/conda-build
Source: security-advisories@github.com

References

https://drive.google.com/file/d/18qe97zxcpTn2l84187A9meGCi2Wg-n_Y/viewExploit, Technical Description
https://github.com/conda/conda-build/commit/f5a6aeef0d5d6940b8c2a88796910dc7476a62bbPatch
https://github.com/conda/conda-build/security/advisories/GHSA-83gh-p93g-cwgxVendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.