Description

Conda is a system-level binary package and environment manager that runs on major operating systems and platforms. Prior to 26.5.2, parse_entry_point_def in conda/common/path/python.py accepted an unvalidated entry-point command from a noarch:python package's info/link.json metadata. CreatePythonEntryPointAction in conda/core/path_actions.py interpolated that command into target_short_path, and PrefixPathAction.target_full_path joined it to the installation prefix without verifying that the result remained under the intended bin or Scripts directory. create_python_entry_point in conda/gateways/disk/create.py then wrote an executable wrapper to the resulting path. A malicious package could use path separators, traversal segments, or an absolute command path to write outside the prefix or overwrite another in-prefix entry point during default install and environment transactions. Out-of-prefix writes require the target parent directory to exist, while an overwritten entry point can execute attacker-controlled Python when later invoked with the installing user's privileges. This issue is fixed in version 26.5.2.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-09-21T16:17:09.010Z",
  "pubdate": "2026-09-21T16:17:09.010Z",
  "executiveSummary": "Conda versions prior to 26.5.2 are susceptible to an arbitrary path traversal and file write vulnerability stemming from improper validation of entry-point definitions within package metadata.\nThis vulnerability exists in the handling of the 'info/link.json' file, where malicious actors can inject traversal sequences or absolute paths into the 'parse_entry_point_def' function.\nThe flaw permits an attacker to escape the intended installation directory (prefix), potentially overwriting critical executable wrappers or writing arbitrary files to the host filesystem.\nSuccessful exploitation requires the installation of a maliciously crafted package by a user. Once executed, the attacker-controlled Python code runs with the privileges of the user who performed the package installation.\nThis represents a significant security risk, as it enables local privilege escalation or arbitrary code execution via entry-point hijacking, particularly when a package is installed into a global or shared environment.",
  "technicalDetails": "The vulnerability originates in the 'conda/common/path/python.py' module, specifically within the 'parse_entry_point_def' function. This function fails to sanitize or validate entry-point commands provided in the 'info/link.json' metadata of 'noarch:python' packages.\nThe attack flow begins when 'CreatePythonEntryPointAction' in 'conda/core/path_actions.py' retrieves the unsanitized command. This command is interpolated into 'target_short_path'. Subsequently, 'PrefixPathAction.target_full_path' joins this path with the target installation prefix without performing canonicalization or boundary checks. This allows the construction of paths containing directory traversal characters (e.g., '../') or absolute filesystem paths.\nWhen 'create_python_entry_point' in 'conda/gateways/disk/create.py' is invoked, it treats the resulting path as a legitimate target for writing an executable wrapper. Because the function does not verify if the resulting path remains within the designated 'bin' or 'Scripts' directory, it executes a write operation to a location outside the intended scope, provided the parent directory exists.\nAn attacker can exploit this behavior in two primary ways: First, by providing a path that escapes the prefix to overwrite system-sensitive files or executables, leading to potential system compromise. Second, by targeting existing entry points within the Conda environment to overwrite them with attacker-supplied Python code. When the victim later invokes the hijacked entry point, the malicious code executes with the installing user's privileges.\nThe vulnerability affects Conda versions prior to 26.5.2. No authentication is required for the installation of the package, but the attacker relies on the target user or system administrator installing the malicious package. The lack of network exposure is typical for package manager vulnerabilities, where the threat vector is the supply chain or repository hosting. Post-exploitation, the attacker gains the ability to execute arbitrary code within the context of the host's Python environment."
}