PT-2025-25585 · Unknown · Conda-Build

Stamparm · Published 2025-06-16 · Updated 2025-06-17 · CVE-2025-32798

Positive Technologies · (AI Summary)

CVSS v3.1

9.8

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions conda-build versions prior to 25.4.0

Description The conda-build recipe processing logic is vulnerable to arbitrary code execution due to unsafe evaluation of recipe selectors. This is because conda-build uses the eval function to process embedded selectors in meta.yaml files without proper sanitization, allowing arbitrary code to be executed during the build process. This compromises the integrity of the build environment and may allow unauthorized commands or file operations to be performed. The issue stems from the risk of using eval() on untrusted input in a context intended to control dynamic build configurations.

Recommendations For versions prior to 25.4.0, update to version 25.4.0 to resolve the issue. As a temporary workaround, consider disabling the use of eval() for recipe processing or restricting the execution of user-defined expressions in meta.yaml files until a patch is applied. Avoid using the eval function for untrusted input in the build process.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2025-32798

GHSA-6CC8-C3C9-3RGR

Affected Products

Conda-Build

References · 8

• 🔥 https://github.com/conda/conda-build/security/advisories/GHSA-6cc8-c3c9-3rgr · Exploit
• https://github.com/conda/conda-build/commit/3d87213b840774a24ab1733664d2b36664233754 · Patch
• https://osv.dev/vulnerability/CVE-2025-32798 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-32798 · Security Note
• https://github.com/conda/conda-build/blob/834448b995eee02cf1c2e7ca97bcfa9affc77ee5/conda_build/metadata.py · Note
• https://t.me/cvetracker/26344 · Telegram Post
• https://twitter.com/CVEnew/status/1934706952946209241 · Twitter Post
• https://t.me/latest_high_impact_cve/2679 · Telegram Post