Description

Rattler is a library that provides common functionality used within the conda ecosystem. `rattler_cache` prior to version 0.9.0 and `py-rattler` prior to version 0.24.0 were vulnerable to package-cache path traversal when handling package metadata from conda channels. During cache materialization, the `ratter_cache` code used the package record `build` string as part of a cache key that was joined into a filesystem path. A malicious or untrusted channel could publish repodata with path separators or traversal components in that field, causing package contents to be written outside the configured package cache directory. The issue requires use of a malicious or otherwise untrusted conda channel. Curated channels that validate package metadata are not expected to allow malformed build strings of this form. Users should upgrade to `rattler_cache` version 0.9.0 or `py-rattler` version 0.24.0 and avoid untrusted conda channels.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-09-09T21:17:03.180Z",
  "pubdate": "2026-09-09T21:17:03.180Z",
  "executiveSummary": "Rattler is susceptible to a path traversal vulnerability originating from improper validation of package metadata within the conda ecosystem.\nThe vulnerability exists in 'rattler_cache' prior to version 0.9.0 and 'py-rattler' prior to version 0.24.0.\nBy manipulating the 'build' string field in malicious repodata, an attacker can force the system to write package contents to arbitrary locations outside the intended package cache directory.\nSuccessful exploitation allows for arbitrary file write operations on the host filesystem with the permissions of the user running the rattler-based tool.\nThis vulnerability is triggered when a user adds or interacts with an untrusted or malicious conda channel.\nWhile curated channels typically sanitize metadata, users operating in environments that permit custom or third-party channels are at significant risk.\nThe primary impact involves potential local system compromise, such as overwriting critical configuration files or binary executables, depending on the attacker's ability to control the materialization process.",
  "technicalDetails": "The root cause of this vulnerability is an insecure implementation of filesystem path construction during the package cache materialization phase. Specifically, the library utilizes the 'build' string—a metadata field defined in the conda repodata—as a component for generating cache keys.\nThese keys are subsequently used to derive local filesystem paths via string concatenation without sufficient sanitization or validation of input characters. When a package record contains path traversal sequences (e.g., '../') or platform-specific directory separators within the 'build' string, the concatenation logic fails to confine the resulting path within the designated cache directory.\nThe exploitation flow begins when an attacker hosts a malicious conda channel containing crafted repodata. A victim client using a vulnerable version of 'rattler_cache' or 'py-rattler' fetches this repodata. Upon attempting to materialize the malicious package, the library interprets the tainted 'build' string as part of the directory structure. The underlying filesystem API then resolves these traversal components, effectively allowing the library to create files or directories at a destination controlled by the attacker relative to the intended base path.\nThis vulnerability does not require authentication to the target system but necessitates the victim's interaction with the malicious channel. It carries no specific network exposure beyond the standard requirement to fetch repodata from an untrusted URI. Because the file write operation occurs during the cache materialization, the payload behavior is limited to the scope of the user's write permissions; however, it can be leveraged to overwrite system files, plant malicious scripts, or manipulate application environments to achieve further code execution or privilege escalation.\nAffected components include the internal path resolution logic within the 'rattler_cache' module and its corresponding bindings in 'py-rattler'. By failing to restrict the 'build' string input to expected alphanumeric and standard build-metadata formats, the library exposes an unsafe interface that assumes the integrity of external channel data."
}