Back to search
CVE-2025-27510
Published: Mar 4, 2025
Modified: Mar 5, 2025
PUBLISHED
Description
conda-forge-metadata provides programatic access to conda-forge's metadata. conda-forge-metadata uses an optional dependency - "conda-oci-mirror" which was neither present on the PyPi repository nor registered by any entity. If conda-oci-mirror is taken over by a threat actor, it can result in remote code execution.
| Vendor | Product | Versions |
|---|---|---|
conda-forge | conda-forge-metadata | affected <= 0.4.1 |
Weaknesses (CWE)
Security Training
Train your team to recognize and prevent security threats with our comprehensive security awareness program.
Start TrainingVulnerability Scanning
Discover vulnerabilities in your applications and infrastructure before attackers do.
Scan Now