PT-2025-45411 · Anaconda · Conda Constructor

Published 2025-11-07 · Updated 2025-11-12 · CVE-2025-64343

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions conda Constructor versions 3.12.2 and below

Description conda Constructor is a tool used to create installers for conda package collections. Versions 3.12.2 and earlier have a configuration where the installation directory receives permissions from its parent directory. When installed outside of restricted directories, these permissions are overly permissive, often granting write access to authenticated users. This allows any logged-in user to make changes during installation, presenting a local attack vector. For single-user installations within shared directories, these permissions remain after installation.

Recommendations Update to version 3.13.0 or later.

Exploit

Fix

Weakness Enumeration

CWE-289

Related Identifiers

CVE-2025-64343

GHSA-VVPR-2QG4-2MRQ

Affected Products

Conda Constructor

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/64xxx/CVE-2025-64343.json · Exploit
• https://osv.dev/vulnerability/CVE-2025-64343 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-64343 · Security Note
• https://github.com/conda/constructor/releases/tag/3.13.0 · Note
• https://github.com/conda/constructor/commit/c368383710a7c2b81ad1b0ecb9724b38d3577447 · Note
• https://github.com/conda/constructor/security/advisories/GHSA-vvpr-2qg4-2mrq · Note
• https://twitter.com/cracbot/status/1988562464922083832 · Twitter Post
• https://twitter.com/CVEnew/status/1986694157738590238 · Twitter Post
• https://twitter.com/offseq/status/1986675332275921060 · Twitter Post
• https://t.me/CVEtracker/36751 · Telegram Post
• https://t.me/cveNotify/142063 · Telegram Post