Skip to content
OpenAdvisories

Vendor

conda-forge

10 known vulnerabilities.

Products

conda-smithy 3 conda-forge-webservices 2 infrastructure 1 conda-forge.github.io 1 conda-forge-metadata 1 openssl-feedstock 1 miniforge 1 conda-forge-ci-setup-feedstock 1
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 7.6
    CVE-2026-46699

    conda-smithy vulnerable to misrouted repository invitation by conda-forge-webservices[bot] due to GitHub username takeover leading to unintended write access in conda-forge feedstock repository

    conda-smithy is a tool for combining a conda recipe with configurations to build using freely hosted CI services into a single repository. Prior to version 3.61.0, a vulnerability in the conda-forge automated webservices allowed unintended write access to fee…

    conda-forge conda-smithy
  • High 7.3
    CVE-2025-35471

    conda-forge openssl-feedstock writable OPENSSLDIR

    conda-forge openssl-feedstock before 066e83c (2024-05-20), on Microsoft Windows, configures OpenSSL to use an OPENSSLDIR file path that can be written to by non-privilged local users. By writing a specially crafted openssl.cnf file in OPENSSLDIR, a non-privil…

    conda-forge miniforge openssl-feedstock
  • High 7.5
    CVE-2025-32784

    conda-forge-webservices has an Unauthorized Artifact Modification Race Condition

    conda-forge-webservices is the web app deployed to run conda-forge admin commands and linting. In versions prior to 2025.4.10, a race condition vulnerability has been identified in the conda-forge-webservices component used within the shared build infrastruct…

    conda-forge conda-forge-webservices