CVE-2025-32800
criticalpriority · track · 39EPSS 0.006 · 51 %ileEUUSEPSS · scored 2026-10-27
Conda-build contains commands and tools to build conda packages. Prior to version 25.3.0, the pyproject.toml lists conda-index as a Python dependency. This package is not published in PyPI. An attacker could claim this namespace and upload arbitrary (malicious) code to the package, and then exploit pip install commands by injecting the malicious dependency in the solve. This issue has been fixed in version 25.3.0. A workaround involves using --no-deps for pip install-ing the project from the repository.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · high–critical · 7.2–9.8
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (2)
Products and version ranges known to be affected.
also known as (2)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (11)
External citations — patches, advisories, analysis.
- https://access.redhat.com/security/cve/cve-2025-32800cnnvd
- https://drive.google.com/file/d/18qe97zxcpTn2l84187A9meGCi2Wg-n_Y/viewcnnvd
- https://github.com/conda/conda-build/commit/f5a6aeef0d5d6940b8c2a88796910dc7476a62bbcnnvd
- https://github.com/conda/conda-build/releasesPatchcnnvd
- https://github.com/conda/conda-build/security/advisories/GHSA-83gh-p93g-cwgxcnnvd
- https://drive.google.com/file/d/18qe97zxcpTn2l84187A9meGCi2Wg-n_Y/viewenisa_euvd
- https://github.com/conda/conda-build/commit/f5a6aeef0d5d6940b8c2a88796910dc7476a62bbenisa_euvd
- https://github.com/conda/conda-build/security/advisories/GHSA-83gh-p93g-cwgxenisa_euvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan