conda-forge

Records10All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical2CVSS 9.0–10.0

CVSS high3CVSS 7.0–8.9

Exploited now

conda-forge records in CISA KEV

No conda-forge vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Miniforge 1 record HIGH Openssl-feedstock 1 record HIGH

Records

10 records

TI-2025-20342 CVE-2025-27510

RCE in the package conda-forge-metadata

HIGH 81

conda-forge-metadata provides programatic access to conda-forge's metadata.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00636 Published 2025-03-04 No fix listed CWE-829

TI-2025-24594 CVE-2025-35471 · GHSA-wv5q-x2gm-xf7j

conda-forge openssl-feedstock writable OPENSSLDIR

HIGH 66

conda-forge openssl-feedstock before 066e83c (2024-05-20), on Microsoft Windows, configures OpenSSL to use an OPENSSLDIR file path that can be written to by non-privilged local users.

CVSS 4.0HIGH 7.0 Local Low privileges User interaction EPSS 0.00229 Published 2025-05-13 Fixed in 066e83c, 24.5.0 CWE-427

TI-2025-31611 CVE-2025-49598

conda-forge-ci-setup Allows Arbitrary Code Execution via Insecure Version Parsing

MEDIUM 56

conda-forge-ci-setup is a package installed by conda-forge each time a build is run on CI.

CVSS 4.0MEDIUM 4.4 Local Low privileges No interaction EPSS 0.00182 Published 2025-06-13 Fixed in 4.15.0 CWE-95

TI-2025-22665 CVE-2025-31484

conda-forge infrastructure uses a bad token for Azure's cf-staging access

MEDIUM 48

conda-forge infrastructure holds common configurations and settings for key pieces of the conda-forge infrastructure.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00415 Published 2025-04-02 No fix listed CWE-284

TI-2025-23821 CVE-2025-32784

conda-forge-webservices has an Unauthorized Artifact Modification Race Condition

LOW 34

conda-forge-webservices is the web app deployed to run conda-forge admin commands and linting.

CVSS 4.0HIGH 7.5 Network High privileges No interaction EPSS 0.00264 Published 2025-04-15 Fixed in 2025.4.10 CWE-367

TI-2026-34328 CVE-2026-46699

Improper access control in conda-forge conda-smithy

LOW 33

conda-smithy is a tool for combining a conda recipe with configurations to build using freely hosted CI services into a single repository.

CVSS 3.1HIGH 7.6 Network No auth User interaction EPSS 0.0033 Published 2026-06-18 Fixed in 3.61.0 CWE-284

TI-2025-31758 CVE-2025-49843

conda-smithy Has Incorrect Default File Permissions

LOW 21

conda-smithy is a tool for combining a conda recipe with configurations to build using freely hosted CI services into a single repository.

CVSS 4.0LOW 2.7 Network No auth No interaction EPSS 0.00623 Published 2025-06-17 Fixed in 3.47.1 CWE-276

TI-2026-79755 CVE-2026-55422

Stored cross-site scripting in conda-forge status dashboard

LOW 20

conda-forge is a GitHub organization containing repositories of conda recipes.

CVSS 3.1MEDIUM 4.6 Network Low privileges User interaction EPSS 0.00162 Published 2026-10-23 No fix listed CWE-79

TI-2025-31739 CVE-2025-49824

conda-smithy Insecure Encryption Vulnerable to Oracle Padding Attack

LOW 9

conda-smithy is a tool for combining a conda recipe with configurations to build using freely hosted CI services into a single repository.

CVSS 4.0LOW 1.7 Network No auth No interaction EPSS 0.0029 Published 2025-06-17 Fixed in 3.47.1 CWE-200

TI-2025-31757 CVE-2025-49842

conda-forge-webservices Privilege Escalation Risk via Default Docker Root User

LOW 6

conda-forge-webservices is the web app deployed to run conda-forge admin commands and linting.

CVSS 4.0LOW 1.0 Local No auth User interaction EPSS 0.00179 Published 2025-06-17 Fixed in 2025.3.24 CWE-276

Open these records in search →

Critical	2
High	3
Medium	2
Low	3
No CVSS	0