Read the docs
TI-2025-23837 Aliases CVE-2025-32800

Conda-build vulnerable to supply chain attack vector due to pyproject.toml referring to dependencies not present in PyPI

Priority LOW 35CWE-1357Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Conda-build contains commands and tools to build conda packages. Prior to version 25.3.0, the pyproject.toml lists conda-index as a Python dependency. This package is not published in PyPI. An attacker could claim this namespace and upload arbitrary (malicious) code to the package, and then exploit pip install commands by injecting the malicious dependency in the solve. This issue has been fixed in version 25.3.0. A workaround involves using --no-deps for pip install-ing the project from the repository.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00646 51st percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed conda-build (conda): 25.3.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
condaconda-buildbefore 25.3.025.3.0Patch availableCNA
  • conda-build Vendorconda Affected before 25.3.0 Fixed in 25.3.0 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:anaconda:conda-build:*:*:*:*:*:*:*:*before 25.3.0VulnerableAnaconda
  • cpe:2.3:a:anaconda:conda-build:*:*:*:*:*:*:*:* Versions before 25.3.0 Vulnerable ·Anaconda

Remediation

  • Fix · CNA conda-build (conda) Fixed in 25.3.0

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-32800
  2. 2026-10-19 EPSS moved to the 50th–90th percentile

References

Exploit 1

Patch 1

Advisory 1

  • TI-2026-38909 Conda: Entry-point path traversal in noarch:python install (arbitrary file write) — canonical Python implementation CVSS 3.1HIGH 8.8
  • TI-2025-23835 Conda-build Allows Arbitrary Code Execution via Malicious Recipe Selectors CVSS 4.0HIGH 8.2
  • TI-2025-23836 Conda-build Vulnerable to Path Traversal via Malicious Tar File CVSS 4.0MEDIUM 5.6
  • TI-2026-79928 Pwn request in Conda infrastructure workflow exposes SYNC_TOKEN CVSS 3.1CRITICAL 9.9
  • TI-2025-39776 (conda) Constructor: Excessive permissions during and after installation CVSS 3.1HIGH 7.8
  • TI-2024-30877 Miniconda3 macOS installers before 23.11.0-1 contain a local privilege escalation… CVSS 3.1HIGH 7.8
See all 11 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences