Skip to content
OpenAdvisories

Vendor

conda-forge

10 known vulnerabilities.

Products

conda-smithy 3 conda-forge-webservices 2 infrastructure 1 conda-forge.github.io 1 conda-forge-metadata 1 openssl-feedstock 1 miniforge 1 conda-forge-ci-setup-feedstock 1
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 4.6
    CVE-2026-55422

    conda-forge.org: Stored DOM XSS via unsanitized dangerouslySetInnerHTML in the status dashboard

    conda-forge is a GitHub organization containing repositories of conda recipes. In commits 85748ad2368a and prior, two React components render externally-sourced strings directly as HTML using dangerouslySetInnerHTML, with no sanitization (the project has no D…

    conda-forge conda-forge.github.io
  • Medium 4.4
    CVE-2025-49598

    conda-forge-ci-setup Allows Arbitrary Code Execution via Insecure Version Parsing

    conda-forge-ci-setup is a package installed by conda-forge each time a build is run on CI. The conda-forge-ci-setup-feedstock setup script is vulnerable due to the unsafe use of the eval function when parsing version information from a custom-formatted meta.y…

    conda-forge conda-forge-ci-setup-feedstock