Vulnerabilities

TI-2025-23837 CVE-2025-32800

Conda-build vulnerable to supply chain attack vector due to pyproject.toml referring to dependencies not present in PyPI

LOW 35

Conda-build contains commands and tools to build conda packages.

CVSS 4.0HIGH 7.2 Network No auth No interaction EPSS 0.00646 Published 2025-06-16 Fixed in 25.3.0 CWE-1357

TI-2025-23836 CVE-2025-32799

MEDIUM 58

Conda-build contains commands and tools to build conda packages.

CVSS 4.0MEDIUM 5.6 Network No auth User interaction EPSS 0.0133 Published 2025-06-16 Fixed in 25.4.0 CWE-22

TI-2025-23835 CVE-2025-32798

HIGH 71

Conda-build contains commands and tools to build conda packages.

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.00831 Published 2025-06-16 Fixed in 25.4.0 CWE-94

TI-2025-23834 CVE-2025-32797

LOW 26

Conda-build contains commands and tools to build conda packages.

CVSS 4.0MEDIUM 6.0 Local No auth No interaction EPSS 0.00172 Published 2025-06-16 Fixed in 25.3.1 CWE-277