PT-2025-25444 · Unknown · Conda-Forge-Ci-Setup
CVSS v4.0
4.4
Medium
| Vector | AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U |
Name of the Vulnerable Software and Affected Versions
conda-forge-ci-setup versions prior to 4.15.0
Description
The conda-forge-ci-setup-feedstock setup script is vulnerable due to the unsafe use of the
eval function when parsing version information from a custom-formatted meta.yaml file. An attacker controlling meta.yaml can inject malicious code into the version assignment, which is executed during file processing, leading to arbitrary code execution. Exploitation requires an attacker to modify the recipe file by manipulating the RECIPE DIR variable and introducing a malicious meta.yaml file. While this is more feasible in CI/CD pipelines, it is uncommon in typical environments, reducing overall risk.Recommendations
For versions prior to 4.15.0, update to version 4.15.0 to fix the vulnerability. As a temporary workaround, consider restricting access to the
meta.yaml file and the RECIPE DIR variable to minimize the risk of exploitation. Avoid using the eval function when parsing version information from custom-formatted files until the issue is resolved.Exploit
Fix
Eval Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Conda-Forge-Ci-Setup