by Kastro
Paper/Archive/CVE-2025-27510

CVE-2025-27510

conda-forge conda-forge-metadata — RCE in the package conda-forge-metadata

EPSS 0.6%public exploitCVSS 9.3
critical.is priorityof 100
48
CVSS 9.3 (CNA)9.3 / 10 × 3027.9Not in CISA KEV+300.0EPSS percentile 50.5.505 × 2010.1Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

conda-forge-metadata provides programatic access to conda-forge's metadata. conda-forge-metadata uses an optional dependency - "conda-oci-mirror" which was neither present on the PyPi repository nor registered by any entity. If conda-oci-mirror is taken over by a threat actor, it can result in remote code execution.

Affected

ProductAffectedFixed inSource
conda-forge-metadata<= 0.4.1–CNA

Scores by source

GitHub_M (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

exploitgithub.com/conda-forge/conda-forge-metadata/security/advisories/GHSA-vwfh-m3q7-9jpwrefgithub.com/conda-forge/conda-forge-metadata/blob/799aee36b21ee06289d73d57838b28201f5a57af/pyproject.toml#L28