Vulnerability · Published Jun 16, 2025 · Assigned by GitHub_M
CVE-2025-32800Conda-build vulnerable to supply chain attack vector due to pyproject.toml referring to dependencies not present in PyPI
High 7.2
In plain English
A high-severity security flaw in conda-build from conda. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 51% of all known vulnerabilities).
Official description
Conda-build contains commands and tools to build conda packages. Prior to version 25.3.0, the pyproject.toml lists conda-index as a Python dependency. This package is not published in PyPI. An attacker could claim this namespace and upload arbitrary (malicious) code to the package, and then exploit pip install commands by injecting the malicious dependency in the solve. This issue has been fixed in version 25.3.0. A workaround involves using --no-deps for pip install-ing the project from the repository.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| conda | conda-build | < 25.3.0 |
Weakness: CWE-1357 · Vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U