Vulnerability · Published Jun 17, 2025 · Assigned by GitHub_M

CVE-2025-49823Conda Constructor Command Injection via Unsanitized User Input (Low)

None 0.0

In plain English

A command injection in constructor from conda. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 5% of all known vulnerabilities).

Severity (CVSS 3.1)0.0None

Exploit odds (30 days)0.2%top 94.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

(conda) Constructor is a tool which allows constructing an installer for a collection of conda packages. Prior to version 3.11.3, shell installer scripts process the installation prefix (user_prefix) using an eval statement, which executes unsanitized user input as shell code. Although the script runs with user privileges (not root), an attacker could exploit this by injecting arbitrary commands through a malicious path during installation. Exploitation requires explicit user action. This issue has been patched in version 3.11.3.

Affected products (as reported)

Vendor	Product	Versions
conda	constructor	< 3.11.3

Weakness: CWE-77 · Vector: CVSS:3.1/AV:P/AC:H/PR:H/UI:R/S:C/C:N/I:N/A:N

References

https://github.com/conda/constructor/security/advisories/GHSA-44q9-rg2q-5g99 x_refsource_CONFIRM
https://github.com/conda/constructor/commit/ce4c2d58cfcde2f62d038fb8aba013176c77a0b1 x_refsource_MISC