Skip to content
OpenAdvisories

Vendor

conda-forge

10 known vulnerabilities.

Products

conda-smithy 3 conda-forge-webservices 2 infrastructure 1 conda-forge.github.io 1 conda-forge-metadata 1 openssl-feedstock 1 miniforge 1 conda-forge-ci-setup-feedstock 1
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Critical 9.3
    CVE-2025-31484

    conda-forge infrastructure uses a bad token for Azure's cf-staging access

    conda-forge infrastructure holds common configurations and settings for key pieces of the conda-forge infrastructure. Between 2025-02-10 and 2025-04-01, conda-forge infrastructure used the wrong token for Azure's cf-staging access. This bug meant that any fee…

    conda-forge infrastructure
  • Critical 9.3
    CVE-2025-27510

    RCE in the package conda-forge-metadata

    conda-forge-metadata provides programatic access to conda-forge's metadata. conda-forge-metadata uses an optional dependency - "conda-oci-mirror" which was neither present on the PyPi repository nor registered by any entity. If conda-oci-mirror is taken over …

    conda-forge conda-forge-metadata