PT-2025-25763 · Unknown · Conda-Smithy

H4Pp1N3Ss · Published 2025-06-17 · Updated 2025-06-18 · CVE-2025-49843

Positive Technologies (AI Summary)

CVSS v4.0

2.7

Low

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions conda-smithy versions prior to 3.47.1

Description The issue concerns a tool that combines a conda recipe with configurations for building using freely hosted CI services. Prior to version 3.47.1, a function in the repository creates files with excessive permissions, allowing unauthorized read and write access. This violates the principle of least privilege and could be exploited by an attacker to access configuration files in shared hosting environments.

Recommendations For versions prior to 3.47.1, update to version 3.47.1 to resolve the issue. As a temporary workaround, consider restricting file permissions to the minimum necessary to prevent unauthorized access.

Exploit

Fix

Incorrect Default Permissions

Weakness Enumeration

CWE-276

Related Identifiers

CVE-2025-49843

GHSA-H9V8-RRQG-3M95

Affected Products

Conda-Smithy

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/49xxx/CVE-2025-49843.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-49843 · Security Note
• https://osv.dev/vulnerability/CVE-2025-49843 · Vendor Advisory
• https://github.com/conda-forge/conda-smithy/security/advisories/GHSA-h9v8-rrqg-3m95 · Note
• https://github.com/conda-forge/conda-smithy/commit/24cc0a55a363479e797c825be3a7f2603ef374a1 · Note
• https://github.com/conda-forge/conda-smithy/blob/1dc21086a476f6aeb6c1bad8bf58474bf3a8f8f0/conda_smithy/ci_register.py#L109-L111 · Note
• https://t.me/cvetracker/26471 · Telegram Post
• https://twitter.com/CVEnew/status/1935078718126571788 · Twitter Post