Read the docs
TI-2025-31738 Aliases CVE-2025-49823

Conda Constructor Command Injection via Unsanitized User Input (Low)

Priority LOW 2CWE-77Published · Updated

Key facts

Attack vector
Physical
Privileges required
High
User interaction
Required
Attack complexity
High
Impact type
Code execution
Confidentiality · integrity · availability
None · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-77.

Summary

(conda) Constructor is a tool which allows constructing an installer for a collection of conda packages. Prior to version 3.11.3, shell installer scripts process the installation prefix (user_prefix) using an eval statement, which executes unsanitized user input as shell code. Although the script runs with user privileges (not root), an attacker could exploit this by injecting arbitrary commands through a malicious path during installation. Exploitation requires explicit user action. This issue has been patched in version 3.11.3.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00161 5th percentileScored 2026-11-07
Fix Fixed constructor (conda): 3.11.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
condaconstructorbefore 3.11.33.11.3Patch availableCNA
  • constructor Vendorconda Affected before 3.11.3 Fixed in 3.11.3 Patch available CNA

Remediation

  • Fix · CNA constructor (conda) Fixed in 3.11.3

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-49823

References

Other 2

  • TI-2026-38909 Conda: Entry-point path traversal in noarch:python install (arbitrary file write) — canonical Python implementation CVSS 3.1HIGH 8.8
  • TI-2025-23835 Conda-build Allows Arbitrary Code Execution via Malicious Recipe Selectors CVSS 4.0HIGH 8.2
  • TI-2025-23836 Conda-build Vulnerable to Path Traversal via Malicious Tar File CVSS 4.0MEDIUM 5.6
  • TI-2026-79928 Pwn request in Conda infrastructure workflow exposes SYNC_TOKEN CVSS 3.1CRITICAL 9.9
  • TI-2025-39776 (conda) Constructor: Excessive permissions during and after installation CVSS 3.1HIGH 7.8
  • TI-2025-23837 Conda-build vulnerable to supply chain attack vector due to pyproject.toml referring to dependencies not present in PyPI CVSS 4.0HIGH 7.2
See all 11 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences