PT-2025-25588 · Python+1 · Pip+2

Jaimergp · Published 2025-06-16 · Updated 2025-08-01 · CVE-2025-32800

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Conda-build versions prior to 25.3.0

Description The issue concerns a dependency injection vulnerability. Conda-build lists conda-index as a Python dependency in its pyproject.toml file. Since conda-index is not published in PyPI, an attacker could claim this namespace, upload malicious code, and exploit pip install commands by injecting the malicious dependency.

Recommendations For versions prior to 25.3.0, update to version 25.3.0 to resolve the issue. As a temporary workaround, consider using the --no-deps option for pip install commands when installing the project from the repository.

Exploit

Fix

Weakness Enumeration

CWE-1357

Related Identifiers

CVE-2025-32800

GHSA-83GH-P93G-CWGX

Affected Products

Conda-Build

Conda-Index

Pip

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/32xxx/CVE-2025-32800.json · Exploit
• 🔥 https://drive.google.com/file/d/18qe97zxcpTn2l84187A9meGCi2Wg-n_Y/view · Exploit
• https://github.com/conda/conda-build/commit/f5a6aeef0d5d6940b8c2a88796910dc7476a62bb · Patch
• https://github.com/conda/conda-build/security/advisories/GHSA-83gh-p93g-cwgx · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-32800 · Security Note
• https://osv.dev/vulnerability/CVE-2025-32800 · Vendor Advisory
• https://t.me/latest_high_impact_cve/2680 · Telegram Post
• https://t.me/cvetracker/26348 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1934738319306281333 · Twitter Post
• https://t.me/cveNotify/130630 · Telegram Post
• https://twitter.com/CVEnew/status/1934716067684737462 · Twitter Post