CVE-2026-53942 Conda Organization Infrastructure: Pwn Request in update workflow allows PR-controlled template rendering with SYNC_TOKEN

Conda Organization Infrastructure is a centralized location for infrastructure codes. Prior to commit 9c0f238, a GitHub Actions Pwn Request vulnerability appears to remain present in conda/conda. The affected workflow is .github/workflows/update.yml. It is triggered by issuecomment events...

CVE-2026-53942

The Conda Organization Infrastructure is vulnerable to a GitHub Actions Pwn Request in the .github/workflows/update.yml workflow within conda/conda. The issue is triggered by issue_comment events containing @conda-bot render or @conda-bot recreate. The workflow retrieves a PR-controlled repositor...

EUVD-2026-109068

Conda Organization Infrastructure is a centralized location for infrastructure codes. Prior to commit 9c0f238, a GitHub Actions Pwn Request vulnerability appears to remain present in conda/conda. The affected workflow is .github/workflows/update.yml. It is triggered by issuecomment events...