CVE-2026-53956

Rattler is a library that provides common functionality used within the conda ecosystem. rattlercache prior to version 0.9.0 and py-rattler prior to version 0.24.0 were vulnerable to package-cache path traversal when handling package metadata from conda channels. During cache materialization, the...

CVE-2026-53956 Rattler vulnerable to package cache path traversal via conda package build string

Rattler is a library that provides common functionality used within the conda ecosystem. rattlercache prior to version 0.9.0 and py-rattler prior to version 0.24.0 were vulnerable to package-cache path traversal when handling package metadata from conda channels. During cache materialization, the...

External Control of File Name or Path

Overview py-rattler is an A blazing fast library to work with the conda ecosystem Affected versions of this package are vulnerable to External Control of File Name or Path via the build string in package metadata during cache materialization. An attacker can cause files to be written outside the...

Rattler vulnerable to package cache path traversal via conda package build string

rattlercache and py-rattler were vulnerable to package-cache path traversal when handling package metadata from conda channels. During cache materialization, the rattercache code used the package record build string as part of a cache key that was joined into a filesystem path. A malicious or...

PT-2026-57043

Name of the Vulnerable Software and Affected Versions rattler cache affected versions not specified py-rattler affected versions not specified Description These components are susceptible to package-cache path traversal when processing package metadata from conda channels. During cache...

External Control of File Name or Path

Overview py-rattler is an A blazing fast library to work with the conda ecosystem Affected versions of this package are vulnerable to External Control of File Name or Path via improper validation of the command field in the entry-point installation process. An attacker can write files outside the...