icon

We found results for “

CVE-2025-32800

Good to know:

icon

Date: June 16, 2025

Conda-build contains commands and tools to build conda packages. Prior to version 25.3.0, the pyproject.toml lists conda-index as a Python dependency. This package is not published in PyPI. An attacker could claim this namespace and upload arbitrary (malicious) code to the package, and then exploit pip install commands by injecting the malicious dependency in the solve. This issue has been fixed in version 25.3.0. A workaround involves using --no-deps for pip install-ing the project from the repository.

Severity Score

Severity Score

Weakness Type (CWE)

Reliance on Insufficiently Trustworthy Component

CWE-1357

Top Fix

icon

Upgrade Version

Upgrade to version conda-build - 25.3.0;https://github.com/conda/conda-build.git - 25.3.0

Learn More

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): HIGH
Privileges Required (PR): NONE
User Interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality (C): HIGH
Integrity (I): HIGH
Availability (A): HIGH

Do you need more information?

Contact Us