PT-2025-51866 · Anaconda · Miniconda3

Published 2025-12-17 · Updated 2025-12-17 · CVE-2024-46062

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Miniconda3 versions prior to 23.11.0-1

Description Miniconda3 macOS installers have a local privilege escalation issue when installed outside a user's home directory. The installation process creates world-writable files and then executes them with root privileges. This allows a local user with limited privileges to inject commands, resulting in code execution with root access.

Recommendations Update to Miniconda3 version 23.11.0-1 or later.

Exploit

Fix

LPE

Incorrect Permission

Command Injection

Weakness Enumeration

CWE-732

CWE-77

Related Identifiers

CVE-2024-46062

Affected Products

Miniconda3

References · 5

• 🔥 https://m8sec.dev/blog/privilege-escalation-macos-pkg-installers · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-46062 · Security Note
• https://osv.dev/vulnerability/CVE-2024-46062 · Vendor Advisory
• https://twitter.com/CVEnew/status/2001365746140536969 · Twitter Post
• https://anaconda.com/docs/getting-started/miniconda/release/23.x#miniconda-23-11-0-1 · Note