CVE-2026-53956

Rattler is a library that provides common functionality used within the conda ecosystem. rattlercache prior to version 0.9.0 and py-rattler prior to version 0.24.0 were vulnerable to package-cache path traversal when handling package metadata from conda channels. During cache materialization, the...

CVE-2026-53956

Rattler is a library that provides common functionality used within the conda ecosystem. "rattlercache" prior to version 0.9.0 and "py-rattler" prior to version 0.24.0 were vulnerable to package-cache path traversal when handling package metadata from conda channels. During cache materialization,...

EUVD-2026-75141

Rattler is a library that provides common functionality used within the conda ecosystem. rattlercache prior to version 0.9.0 and py-rattler prior to version 0.24.0 were vulnerable to package-cache path traversal when handling package metadata from conda channels. During cache materialization, the...

CVE-2026-53956 Rattler vulnerable to package cache path traversal via conda package build string

Rattler is a library that provides common functionality used within the conda ecosystem. rattlercache prior to version 0.9.0 and py-rattler prior to version 0.24.0 were vulnerable to package-cache path traversal when handling package metadata from conda channels. During cache materialization, the...

CVE-2026-53956

Rattler is a library providing common functionality for the conda ecosystem. rattler_cache prior to 0.9.0 and py-rattler prior to 0.24.0 are vulnerable to package-cache path traversal . During cache materialization, the package record build string is joined into a filesystem path without proper s...

mahoraga (>=0.5.1, <=0.6.0), pixi-browse (>=0.0.1, <=0.0.13) +5 more potentially affected by CVE-2026-53956 via py-rattler (>=0.5.0, <=0.23.2)

py-rattler PYPI version =0.5.0, =0.5.1, =0.0.1, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.10.3 Source cves: CVE-2026-53956 Source advisory: MEND:CVE-2026-53956...

CVE-2026-53956: Improper Limitation of a Pathname to a Restricted Directory

Rattler is a library that provides common functionality used within the conda ecosystem. rattlercache prior to version 0.9.0 and py-rattler prior to version 0.24.0 were vulnerable to package-cache path traversal when handling package metadata from conda channels. During cache materialization, the...

CVE-2026-47425

Rattler is a library that provides common functionality used within the conda ecosystem. Prior to version 0.43.2, EntryPoint::FromStr in rattlercondatypes performs only .trim on the command field before the linker joins it onto the install prefix and writes an executable Python script. A maliciou...

CVE-2026-47425 Rattler vulnerable to entry-point path traversal in noarch:python install (arbitrary file write)

Rattler is a library that provides common functionality used within the conda ecosystem. Prior to version 0.43.2, EntryPoint::FromStr in rattlercondatypes performs only .trim on the command field before the linker joins it onto the install prefix and writes an executable Python script. A maliciou...

CVE-2026-47425

Summary: CVE-2026-47425 affects rattler before 0.43.2, enabling a noarch:python entry-point path traversal that can write files outside the intended install prefix. The issue arises in EntryPoint::FromStr within rattler_conda_types, where only .trim() is applied to the command and a malicious noa...

CVE-2026-47425

Rattler is a library that provides common functionality used within the conda ecosystem. Prior to version 0.43.2, EntryPoint::FromStr in rattlercondatypes performs only .trim on the command field before the linker joins it onto the install prefix and writes an executable Python script. A maliciou...

CVE-2026-47425 Rattler vulnerable to entry-point path traversal in noarch:python install (arbitrary file write)

Rattler is a library that provides common functionality used within the conda ecosystem. Prior to version 0.43.2, EntryPoint::FromStr in rattlercondatypes performs only .trim on the command field before the linker joins it onto the install prefix and writes an executable Python script. A maliciou...

mahoraga (>=0.5.1, <=0.6.0), pixi-browse (>=0.0.1, <=0.0.13) +5 more potentially affected by CVE-2026-47425 via py-rattler (>=0.5.0, <=0.23.2)

py-rattler PYPI version =0.5.0, =0.5.1, =0.0.1, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.10.3 Source cves: CVE-2026-47425 Source advisory: MEND:CVE-2026-47425...

CVE-2026-47425

Rattler is a library that provides common functionality used within the conda ecosystem. Prior to version 0.43.2, "EntryPoint::FromStr" in "rattlercondatypes" performs only ".trim" on the "command" field before the linker joins it onto the install prefix and writes an executable Python script. A...

CVE-2026-47425 Rattler vulnerable to entry-point path traversal in noarch:python install (arbitrary file write)

Rattler is a library that provides common functionality used within the conda ecosystem. Prior to version 0.43.2, EntryPoint::FromStr in rattlercondatypes performs only .trim on the command field before the linker joins it onto the install prefix and writes an executable Python script. A maliciou...

EUVD-2026-46348

Rattler is a library that provides common functionality used within the conda ecosystem. Prior to version 0.43.2, EntryPoint::FromStr in rattlercondatypes performs only .trim on the command field before the linker joins it onto the install prefix and writes an executable Python script. A maliciou...

CVE-2026-47425: Improper Limitation of a Pathname to a Restricted Directory

Rattler is a library that provides common functionality used within the conda ecosystem. Prior to version 0.43.2, EntryPoint::FromStr in rattlercondatypes performs only .trim on the command field before the linker joins it onto the install prefix and writes an executable Python script. A maliciou...

Path Traversal

py-rattler are vulnerable to Path Traversal. The vulnerability is due to improper validation of the package record build string used to construct cache file paths during package cache materialization, which allows an attacker controlling a malicious or untrusted conda channel to inject path...

mahoraga (>=0.5.1, <=0.6.0), pixi-browse (>=0.0.1, <=0.0.13) +5 more potentially affected by CVE-2026-53956 via py-rattler (>=0.5.0, <=0.23.2)

py-rattler PYPI version =0.5.0, =0.5.1, =0.0.1, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.10.3 Source cves: CVE-2026-53956 Source advisory: OSV:PYSEC-2026-2970...

Rattler vulnerable to package cache path traversal via conda package build string

rattlercache and py-rattler were vulnerable to package-cache path traversal when handling package metadata from conda channels.During cache materialization, the rattercache code used the package record build string as part of a cache key that was joined into a filesystem path. A malicious or...