328 matches found
CVE-2026-53942
Conda Organization Infrastructure is a centralized location for infrastructure codes. Prior to commit 9c0f238, a GitHub Actions Pwn Request vulnerability appears to remain present in conda/conda. The affected workflow is .github/workflows/update.yml. It is triggered by issuecomment events...
EUVD-2026-109068
Conda Organization Infrastructure is a centralized location for infrastructure codes. Prior to commit 9c0f238, a GitHub Actions Pwn Request vulnerability appears to remain present in conda/conda. The affected workflow is .github/workflows/update.yml. It is triggered by issuecomment events...
CVE-2026-53942
The Conda Organization Infrastructure is vulnerable to a GitHub Actions Pwn Request in the .github/workflows/update.yml workflow within conda/conda. The issue is triggered by issue_comment events containing @conda-bot render or @conda-bot recreate. The workflow retrieves a PR-controlled repositor...
CVE-2026-53942 Conda Organization Infrastructure: Pwn Request in update workflow allows PR-controlled template rendering with SYNC_TOKEN
Conda Organization Infrastructure is a centralized location for infrastructure codes. Prior to commit 9c0f238, a GitHub Actions Pwn Request vulnerability appears to remain present in conda/conda. The affected workflow is .github/workflows/update.yml. It is triggered by issuecomment events...
CVE-2026-53942 Conda Organization Infrastructure: Pwn Request in update workflow allows PR-controlled template rendering with SYNC_TOKEN
Conda Organization Infrastructure is a centralized location for infrastructure codes. Prior to commit 9c0f238, a GitHub Actions Pwn Request vulnerability appears to remain present in conda/conda. The affected workflow is .github/workflows/update.yml. It is triggered by issuecomment events...
CVE-2026-55422
conda-forge is a GitHub organization containing repositories of conda recipes. In commits 85748ad2368a and prior, two React components render externally-sourced strings directly as HTML using dangerouslySetInnerHTML, with no sanitization the project has no DOMPurify or equivalent dependency. JSON...
CVE-2026-55422
The conda-forge website is vulnerable to Stored DOM XSS due to the unsanitized use of dangerouslySetInnerHTML in two React components within the status dashboard. The root cause is that the site renders raw output—such as build logs and tracebacks—captured by the autotick bot (regro/cf-scripts) d...
stumpy
|PyPI Version| |Conda Forge Version| |PyPI Downloads| |License| |Test Status| |Code Coverage| |RTD Status| |Binder| |JOSS| |NumFOCUS| .. |PyPI Version| image:: https://img.shields.io/pypi/v/stumpy.svg :target: https://pypi.org/project/stumpy/ :alt: PyPI Version .. |Conda Forge Version| image::...
PT-2026-122128
Conda Organization Infrastructure is a centralized location for infrastructure codes. Prior to commit 9c0f238, a GitHub Actions Pwn Request vulnerability appears to remain present in conda/conda. The affected workflow is .github/workflows/update.yml. It is triggered by issue comment events...
CVE-2026-53940 affecting package conda for versions less than 24.3.0-5
CVE-2026-53940 affecting package conda for versions less than 24.3.0-5. A patched version of the package is available...
appcensus-dynamic-repos (>=2.0.113, <=2.1.117), boulder-opal-scale-up (>=1.0.7, <=1.0.12) +32 more potentially affected by unknown CVE via dulwich (0.22.8)
dulwich PYPI version 0.22.8 is affected by a known vulnerability. The following packages have a transitive dependency on dulwich and may be impacted: - appcensus-dynamic-repos =2.0.113, =1.0.7, =3.0.0, =0.1.1, =0.1.0, =0.1.171, =0.1.0, =8.0.1, =0.0.0b0, =2.25.1, =0.4.16.post1, =1.10.0rc3, =4.7.5,...
CVE-2026-53940
A flaw was found in Conda, a system-level binary package and environment manager. An unvalidated entry-point command in a noarch:python package's metadata allows a malicious package to use path traversal. This enables writing files outside the intended installation directory or overwriting existi...
AZL-103394 CVE-2026-53940 affecting package conda 24.3.0-4
Conda is a system-level binary package and environment manager that runs on major operating systems and platforms. Prior to 26.5.2, parseentrypointdef in conda/common/path/python.py accepted an unvalidated entry-point command from a noarch:python package's info/link.json metadata...
CVE-2026-53940
Conda is a system-level binary package and environment manager that runs on major operating systems and platforms. Prior to 26.5.2, parseentrypointdef in conda/common/path/python.py accepted an unvalidated entry-point command from a noarch:python package's info/link.json metadata...
CVE-2026-53940 Conda: Entry-point path traversal in noarch:python install (arbitrary file write) — canonical Python implementation
Conda is a system-level binary package and environment manager that runs on major operating systems and platforms. Prior to 26.5.2, parseentrypointdef in conda/common/path/python.py accepted an unvalidated entry-point command from a noarch:python package's info/link.json metadata...
EUVD-2026-83974
Conda is a system-level binary package and environment manager that runs on major operating systems and platforms. Prior to 26.5.2, parseentrypointdef in conda/common/path/python.py accepted an unvalidated entry-point command from a noarch:python package's info/link.json metadata...
CVE-2026-53940 Conda: Entry-point path traversal in noarch:python install (arbitrary file write) — canonical Python implementation
Conda is a system-level binary package and environment manager that runs on major operating systems and platforms. Prior to 26.5.2, parseentrypointdef in conda/common/path/python.py accepted an unvalidated entry-point command from a noarch:python package's info/link.json metadata...
CVE-2026-53940 Conda: Entry-point path traversal in noarch:python install (arbitrary file write) — canonical Python implementation
Conda is a system-level binary package and environment manager that runs on major operating systems and platforms. Prior to 26.5.2, parseentrypointdef in conda/common/path/python.py accepted an unvalidated entry-point command from a noarch:python package's info/link.json metadata...
CVE-2026-53940
Conda versions prior to 26.5.2 are vulnerable to a path traversal during noarch:python package installation. The function parse_entry_point_def in conda/common/path/python.py accepted an unvalidated entry-point command from a package's info/link.json metadata, which was then interpolated into the...
PT-2026-104828
Conda is a system-level binary package and environment manager that runs on major operating systems and platforms. Prior to 26.5.2, parse entry point def in conda/common/path/python.py accepted an unvalidated entry-point command from a noarch:python package's info/link.json metadata...