Read the docs
TI-2025-23835 Aliases CVE-2025-32798

Conda-build Allows Arbitrary Code Execution via Malicious Recipe Selectors

Priority HIGH 71CWE-94Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-94.

Summary

Conda-build contains commands and tools to build conda packages. Prior to version 25.4.0, the conda-build recipe processing logic has been found to be vulnerable to arbitrary code execution due to unsafe evaluation of recipe selectors. Currently, conda-build uses the eval function to process embedded selectors in meta.yaml files. This approach evaluates user-defined expressions without proper sanitization, which allows arbitrary code to be executed during the build process. As a result, the integrity of the build environment is compromised, and unauthorized commands or file operations may be performed. The vulnerability stems from the inherent risk of using eval() on untrusted input in a context intended to control dynamic build configurations. By directly interpreting selector expressions, conda-build creates a potential execution pathway for malicious code, violating security assumptions. This issue has been patched in version 25.4.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00831 57th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed conda-build (conda): 25.4.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
condaconda-buildbefore 25.4.025.4.0Patch availableCNA
  • conda-build Vendorconda Affected before 25.4.0 Fixed in 25.4.0 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:anaconda:conda-build:*:*:*:*:*:*:*:*before 25.4.0VulnerableAnaconda
  • cpe:2.3:a:anaconda:conda-build:*:*:*:*:*:*:*:* Versions before 25.4.0 Vulnerable ·Anaconda

Remediation

  • Fix · CNA conda-build (conda) Fixed in 25.4.0

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-32798

References

Exploit 1

Patch 1

Other 1

  • TI-2026-38909 Conda: Entry-point path traversal in noarch:python install (arbitrary file write) — canonical Python implementation CVSS 3.1HIGH 8.8
  • TI-2025-23836 Conda-build Vulnerable to Path Traversal via Malicious Tar File CVSS 4.0MEDIUM 5.6
  • TI-2026-79928 Pwn request in Conda infrastructure workflow exposes SYNC_TOKEN CVSS 3.1CRITICAL 9.9
  • TI-2025-39776 (conda) Constructor: Excessive permissions during and after installation CVSS 3.1HIGH 7.8
  • TI-2025-23837 Conda-build vulnerable to supply chain attack vector due to pyproject.toml referring to dependencies not present in PyPI CVSS 4.0HIGH 7.2
  • TI-2024-30877 Miniconda3 macOS installers before 23.11.0-1 contain a local privilege escalation… CVSS 3.1HIGH 7.8
See all 11 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences