CVE-2026-53940

A flaw was found in Conda, a system-level binary package and environment manager. An unvalidated entry-point command in a noarch:python package's metadata allows a malicious package to use path traversal. This enables writing files outside the intended installation directory or overwriting existi...