CVE-2025-32797

Conda-build contains commands and tools to build conda packages. Prior to version 25.3.1, the write_build_scripts function in conda-build creates the temporary build script conda_build.sh with overly permissive file permissions (0o766), allowing write access to all users. Attackers with filesystem access can exploit a race condition to overwrite the script before execution, enabling arbitrary code execution under the victim's privileges. This risk is significant in shared environments, potentially leading to full system compromise. Even with non-static directory names, attackers can monitor parent directories for file creation events. The brief window between script creation (with insecure permissions) and execution allows rapid overwrites. Directory names can also be inferred via timestamps or logs, and automation enables exploitation even with semi-randomized paths by acting within milliseconds of detection. This issue has been patched in version 25.3.1. A workaround involves restricting conda_build.sh permissions from 0o766 to 0o700 (owner-only read/write/execute). Additionally, use atomic file creation (write to a temporary randomized filename and rename atomically) to minimize the race condition window.

• CWE-277

• https://github.com/conda/conda-build/blob/3f06913bba22c4e1ef1065df9e00d86ac97f087c/conda_build/build.py#L3054-L3084Product
• https://github.com/conda/conda-build/commit/d246e49c8f45e8033915156ee3d77769926f3c2ePatch
• https://github.com/conda/conda-build/pull/5Issue Tracking
• https://github.com/conda/conda-build/security/advisories/GHSA-vfp6-3v8g-vcmmVendor Advisory

Published

Jun 16, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-32791The Backstage Scaffolder plugin houses types and utilities f…4.3
• CVE-2025-32792SES safely executes third-party JavaScript 'strict' mode pro…8.7
• CVE-2025-32793Cilium is a networking, observability, and security solution…4
• CVE-2025-32794OpenEMR is a free and open source electronic health records …7.6
• CVE-2025-32795Dify is an open-source LLM app development platform. Prior t…6.5
• CVE-2025-32796Dify is an open-source LLM app development platform. Prior t…6.5
• CVE-2025-32798Conda-build contains commands and tools to build conda packa…9.8
• CVE-2025-32799Conda-build contains commands and tools to build conda packa…9.8
• CVE-2025-3280The ELEX WooCommerce Advanced Bulk Edit Products, Prices & A…6.5
• CVE-2025-32800Conda-build contains commands and tools to build conda packa…9.8
• CVE-2025-32801Kea configuration and API directives can be used to load a m…7.8
• CVE-2025-32802Kea configuration and API directives can be used to overwrit…6.1