PT-2025-51858 · Anaconda · Anaconda3

Published 2025-12-17 · Updated 2025-12-17 · CVE-2024-46060

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Anaconda3 versions prior to 2024.06-1

Description Anaconda3 macOS installers are susceptible to a local privilege escalation issue when installed outside a user's home directory. The installation process creates world-writable files and executes them with root privileges. This allows a local, low-privileged user to inject arbitrary commands, potentially resulting in code execution as the root user.

Recommendations Versions prior to 2024.06-1 should be updated to version 2024.06-1 or later.

Exploit

Fix

LPE

Incorrect Permission

Command Injection

Weakness Enumeration

CWE-732

CWE-77

Related Identifiers

CVE-2024-46060

Affected Products

Anaconda3

References · 6

• 🔥 https://m8sec.dev/blog/privilege-escalation-macos-pkg-installers · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-46060 · Security Note
• https://osv.dev/vulnerability/CVE-2024-46060 · Vendor Advisory
• https://anaconda.com/docs/getting-started/anaconda/release/2024.x#anaconda-2024-06-1 · Note
• https://twitter.com/CVEnew/status/2001365745150640446 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2001419053563265179 · Twitter Post