conda-forge
Products
| Product | CVEs | Exploited | Latest |
|---|---|---|---|
| conda-smithy | 3 | – | Jun 18, 2026 |
| conda-forge-webservices | 2 | – | Jun 17, 2025 |
| conda-forge-metadata | 1 | – | Mar 4, 2025 |
| infrastructure | 1 | – | Apr 2, 2025 |
| miniforge | 1 | – | May 13, 2025 |
| conda-forge-ci-setup-feedstock | 1 | – | Jun 13, 2025 |
| openssl-feedstock | 1 | – | May 13, 2025 |
| conda-forge.github.io | 1 | – | Oct 23, 2026 |
Exploited and recent CVEs
- CVE-2026-55422 conda-forge.org: Stored DOM XSS via unsanitized dangerouslySetInnerHTML in the status dashboard 0.2%
- CVE-2026-46699 conda-smithy vulnerable to misrouted repository invitation by conda-forge-webservices[bot] due to GitHub username takeover leading to unintended write access in conda-forge feedstock repository 0.3%
- CVE-2025-49824 conda-smithy Insecure Encryption Vulnerable to Oracle Padding Attack 0.3%
- CVE-2025-49843 conda-smithy Has Incorrect Default File Permissions 0.6%
- CVE-2025-49842 conda-forge-webservices Privilege Escalation Risk via Default Docker Root User 0.2%
- CVE-2025-49598 conda-forge-ci-setup Allows Arbitrary Code Execution via Insecure Version Parsing 0.2%
- CVE-2025-35471 conda-forge openssl-feedstock writable OPENSSLDIR 0.2%
- CVE-2025-35471 conda-forge openssl-feedstock writable OPENSSLDIR 0.2%
- CVE-2025-32784 conda-forge-webservices has an Unauthorized Artifact Modification Race Condition 0.3%
- CVE-2025-31484 conda-forge infrastructure uses a bad token for Azure's cf-staging access 0.4%
- CVE-2025-27510 RCE in the package conda-forge-metadata 0.6%