Conda-forge vulnerabilities
We track 5 vulnerabilities in Conda-forge products across 6 products. 5 are rated high or critical, and none are known to be exploited. The most recent was published on June 18, 2026.
Latest Conda-forge vulnerabilities
- 7.6 High severity
conda-smithy: Improper Access Control
conda-smithy is a tool for combining a conda recipe with configurations to build using freely hosted CI services into a single repository. Prior to version 3.61.0, a vulnerability in the conda-forge automated webservices allowed unintended write access to feed
- 7.8 High severity
openssl-feedstock: Uncontrolled Search Path Element
conda-forge openssl-feedstock before 066e83c (2024-05-20), on Microsoft Windows, configures OpenSSL to use an OPENSSLDIR file path that can be written to by non-privilged local users. By writing a specially crafted openssl.cnf file in OPENSSLDIR, a non-privile
- 7.5 High severity
conda-forge-webservices: Time-of-check Time-of-use (TOCTOU) Race Condition
conda-forge-webservices is the web app deployed to run conda-forge admin commands and linting. In versions prior to 2025.4.10, a race condition vulnerability has been identified in the conda-forge-webservices component used within the shared build infrastructu
- 9.3 Critical severity
infrastructure: Improper Access Control
conda-forge infrastructure holds common configurations and settings for key pieces of the conda-forge infrastructure. Between 2025-02-10 and 2025-04-01, conda-forge infrastructure used the wrong token for Azure's cf-staging access. This bug meant that any feed
- 9.3 Critical severity
conda-forge-metadata: Inclusion of Functionality from Untrusted Control Sphere
conda-forge-metadata provides programatic access to conda-forge's metadata. conda-forge-metadata uses an optional dependency - "conda-oci-mirror" which was neither present on the PyPi repository nor registered by any entity. If conda-oci-mirror is taken over b