PT-2026-45490 · Rattler+3 · Rattler+3
CVE-2026-47425
·
Published
2026-06-01
·
Updated
2026-07-23
CVSS v4.0
6.9
Medium
| Vector | AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
rattler versions prior to 0.43.2
pixi versions prior to 0.69.0
rattler-build versions prior to 0.65.0
py-rattler (affected versions not specified)
Description
The
EntryPoint::FromStr function in rattler conda types only applies a .trim() operation to the command field before the linker joins it to the install prefix to create an executable Python script. A malicious noarch:python package can include an info/link.json file with an entry-point name containing absolute paths or path traversal characters such as .., /, or ``. This allows the resulting file to be written outside the intended prefix or overwrite existing entry-points, such as bin/pip. On Unix systems, the file is written with mode 0o775, while on Windows, a launcher .exe is copied.Recommendations
Update rattler to version 0.43.2 or later.
Update pixi to version 0.69.0 or later.
Update rattler-build to version 0.65.0 or later.
Exploit
Fix
Path traversal
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Pixi
Py-Rattler
Rattler
Rattler-Build