Vulnerability · Published Jun 17, 2025 · Assigned by GitHub_M

CVE-2025-49843conda-smithy Has Incorrect Default File Permissions

Low 2.7

In plain English

A low-severity incorrect default permissions in conda-smithy from conda-forge. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 50% of all known vulnerabilities).

Severity (CVSS 4.0)2.7Low

Exploit odds (30 days)0.6%top 49.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

conda-smithy is a tool for combining a conda recipe with configurations to build using freely hosted CI services into a single repository. Prior to version 3.47.1, the travis_headers function in the conda-smithy repository creates files with permissions exceeding 0o600, allowing read and write access beyond the intended user/owner. This violates the principle of least privilege, which mandates restricting file permissions to the minimum necessary. An attacker could exploit this to access configuration files in shared hosting environments. This issue has been patched in version 3.47.1.

Affected products (as reported)

Vendor	Product	Versions
conda-forge	conda-smithy	< 3.47.1

Weakness: CWE-276 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U

References

https://github.com/conda-forge/conda-smithy/security/advisories/GHSA-h9v8-rrqg-3m95 x_refsource_CONFIRM
https://github.com/conda-forge/conda-smithy/commit/24cc0a55a363479e797c825be3a7f2603ef374a1 x_refsource_MISC
https://github.com/conda-forge/conda-smithy/blob/1dc21086a476f6aeb6c1bad8bf58474bf3a8f8f0/conda_smithy/ci_register.py#L109-L111 x_refsource_MISC