30 matches found
GO-2025-3678 vulnerabilities
Vulnerabilities for packages: samply, wasm-pack, sccache, wasmcloud, wadm, zed, pixi, rye, wash, buck2, cargo-audit, parseable, nushell, deno, ntpd-rs, sdp-k8s-injector, atuin, sqlx, kdash, rustls-ffi, rustup, shadowsocks-rust, linkerd-extension-init, tealdeer, zizmor, oranda, xh, lychee, uv,...
CVE-2026-47425: Improper Limitation of a Pathname to a Restricted Directory
Rattler is a library that provides common functionality used within the conda ecosystem. Prior to version 0.43.2, EntryPoint::FromStr in rattlercondatypes performs only .trim on the command field before the linker joins it onto the install prefix and writes an executable Python script. A maliciou...
CVE-2026-50185 vulnerabilities
Vulnerabilities for packages: yazi, deno, mountpoint-s3, pixi, komodo, apollo-router...
GHSA-3RJW-M598-PQ24 vulnerabilities
Vulnerabilities for packages: yazi, deno, mountpoint-s3, pixi, komodo, apollo-router...
GHSA-Q53Q-5R4J-5729 rattler has an entry-point path traversal in noarch:python install (arbitrary file write)
Summary EntryPoint::FromStr in rattlercondatypes performs only .trim on the command field before the linker joins it onto the install prefix and writes an executable Python script. A malicious noarch:python package can ship an info/link.json with an entry-point name containing .., /, , or an...
rattler has an entry-point path traversal in noarch:python install (arbitrary file write)
Summary EntryPoint::FromStr in rattlercondatypes performs only .trim on the command field before the linker joins it onto the install prefix and writes an executable Python script. A malicious noarch:python package can ship an info/link.json with an entry-point name containing .., /, , or an...
CVE-2025-4574 vulnerabilities
Vulnerabilities for packages: starship, zed, oxipng, nushell, cargo-c, deno, yara-x, samply, rust-analyzer, fd, pixi, cargo-audit, oranda, lychee, wasmcloud, ruff, wadm, yazi...
CVE-2025-4574 vulnerabilities
Vulnerabilities for packages: cargo-audit, oxipng, fd, samply, zed, yazi, deno, lychee, cargo-c, oranda, rust-analyzer, ruff, wadm, wasmcloud, nushell, pixi, yara-x, ztunnel, starship...
CVE-2025-62518 vulnerabilities
Vulnerabilities for packages: pixi...
GHSA-J5GW-2VRG-8FGX vulnerabilities
Vulnerabilities for packages: pixi...
CVE-2025-62518 vulnerabilities
Vulnerabilities for packages: pixi...
GHSA-J5GW-2VRG-8FGX vulnerabilities
Vulnerabilities for packages: pixi...
CVE-2025-55159 vulnerabilities
Vulnerabilities for packages: efs-utils, pixi, linkerd2, linkerd-extension-init, shadowsocks-rust, buck2, mdbook, uv, zola, linkerd2-proxy...
GHSA-QX2V-8332-M4FV vulnerabilities
Vulnerabilities for packages: efs-utils, pixi, linkerd2, linkerd-extension-init, shadowsocks-rust, buck2, mdbook, uv, zola, linkerd2-proxy...
GHSA-QX2V-8332-M4FV vulnerabilities
Vulnerabilities for packages: zola, buck2, linkerd-extension-init, mdbook, shadowsocks-rust, linkerd2-proxy, uv, jujutsu, pixi, efs-utils, linkerd2...
CVE-2025-55159 vulnerabilities
Vulnerabilities for packages: zola, buck2, linkerd-extension-init, mdbook, shadowsocks-rust, linkerd2-proxy, uv, jujutsu, pixi, efs-utils, linkerd2...
GHSA-4P46-PWFR-66X6 vulnerabilities
Vulnerabilities for packages: cargo-audit, zizmor, atuin, uv, rustup, samply, sccache, zed, tealdeer, zola, deno, lychee, linkerd-extension-init, wash, oranda, wasm-pack, qdrant, wadm, sqlx, wasmcloud, fnm, parseable, ntpd-rs, buck2, nushell, rye, shadowsocks-rust, xh, pixi, kdash, rustls-ffi,...
GHSA-QG5G-GV98-5FFH vulnerabilities
Vulnerabilities for packages: parseable, ntpd-rs, wash, cargo-audit, wasm-pack, qdrant, uv, wadm, xh, wasmcloud, fnm, pixi, zed, tealdeer...