Read the docs
TI-2026-34988 Aliases CVE-2026-47425GHSA-q53q-5r4j-5729

Rattler vulnerable to entry-point path traversal in noarch:python install (arbitrary file write)

Priority LOW 30CWE-22Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · High · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub.

Summary

Rattler is a library that provides common functionality used within the conda ecosystem. Prior to version 0.43.2, `EntryPoint::FromStr` in `rattler_conda_types` performs only `.trim()` on the `command` field before the linker joins it onto the install prefix and writes an executable Python script. A malicious `noarch:python` package can ship an `info/link.json` with an entry-point name containing `..`, `/`, `\`, or an absolute path; the resulting file is written outside the prefix (or clobbers an existing in-prefix entry-point such as `bin/pip`) with mode `0o775` on Unix and a copied launcher `.exe` on Windows. This affects the default install path of `pixi install`, `mamba install` via py-rattler, `rattler-build`, and any other consumer of the `rattler` install crate; no flag or post-link-script opt-in is involved. Version 0.43.2 contains a fix for the issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00196 9th percentileScored 2026-11-07
Fix Fixed rattler (conda): 0.43.2py-rattler (conda): 0.24.0+4 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
condarattlerbefore 0.43.20.43.2Patch availableCNA
condapy-rattlerbefore 0.24.00.24.0Patch availableCNA
condarattler-buildbefore 0.65.00.65.0Patch availableCNA
prefix-devpixibefore 0.69.00.69.0Patch availableCNA
—rattler (crates.io)before 0.43.20.43.2Patch availableGHSA-q53q-5r4j-5729
—py-rattler (PyPI)before 0.24.00.24.0Patch availableGHSA-q53q-5r4j-5729
  • rattler Vendorconda Affected before 0.43.2 Fixed in 0.43.2 Patch available CNA
  • py-rattler Vendorconda Affected before 0.24.0 Fixed in 0.24.0 Patch available CNA
  • rattler-build Vendorconda Affected before 0.65.0 Fixed in 0.65.0 Patch available CNA
  • pixi Vendorprefix-dev Affected before 0.69.0 Fixed in 0.69.0 Patch available CNA
  • rattler (crates.io) Vendor— Affected before 0.43.2 Fixed in 0.43.2 Patch available GHSA-q53q-5r4j-5729
  • py-rattler (PyPI) Vendor— Affected before 0.24.0 Fixed in 0.24.0 Patch available GHSA-q53q-5r4j-5729

Remediation

  • Fix · CNA rattler (conda) Fixed in 0.43.2
  • Fix · CNA py-rattler (conda) Fixed in 0.24.0
  • Fix · CNA rattler-build (conda) Fixed in 0.65.0
  • Fix · CNA pixi (prefix-dev) Fixed in 0.69.0
  • Fix · GHSA-q53q-5r4j-5729 rattler (crates.io) Fixed in 0.43.2 Advisory →
  • Fix · GHSA-q53q-5r4j-5729 py-rattler (PyPI) Fixed in 0.24.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-47425
  2. 2026-10-03 Alias added: GHSA-q53q-5r4j-5729

References

Other 4

  • TI-2026-38909 Conda: Entry-point path traversal in noarch:python install (arbitrary file write) — canonical Python implementation CVSS 3.1HIGH 8.8
  • TI-2025-23835 Conda-build Allows Arbitrary Code Execution via Malicious Recipe Selectors CVSS 4.0HIGH 8.2
  • TI-2025-23836 Conda-build Vulnerable to Path Traversal via Malicious Tar File CVSS 4.0MEDIUM 5.6
  • TI-2026-79928 Pwn request in Conda infrastructure workflow exposes SYNC_TOKEN CVSS 3.1CRITICAL 9.9
  • TI-2025-39776 (conda) Constructor: Excessive permissions during and after installation CVSS 3.1HIGH 7.8
  • TI-2025-23837 Conda-build vulnerable to supply chain attack vector due to pyproject.toml referring to dependencies not present in PyPI CVSS 4.0HIGH 7.2
See all 11 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences