CVE-2025-32798

Conda-build contains commands and tools to build conda packages. Prior to version 25.4.0, the conda-build recipe processing logic has been found to be vulnerable to arbitrary code execution due to unsafe evaluation of recipe selectors. Currently, conda-build uses the eval function to process embedded selectors in meta.yaml files. This approach evaluates user-defined expressions without proper sanitization, which allows arbitrary code to be executed during the build process. As a result, the integrity of the build environment is compromised, and unauthorized commands or file operations may be performed. The vulnerability stems from the inherent risk of using eval() on untrusted input in a context intended to control dynamic build configurations. By directly interpreting selector expressions, conda-build creates a potential execution pathway for malicious code, violating security assumptions. This issue has been patched in version 25.4.0.

• CWE-94

• https://github.com/conda/conda-build/blob/834448b995eee02cf1c2e7ca97bcfa9affc77ee5/conda_build/metadata.pyProduct
• https://github.com/conda/conda-build/commit/3d87213b840774a24ab1733664d2b36664233754Patch
• https://github.com/conda/conda-build/security/advisories/GHSA-6cc8-c3c9-3rgrExploit, Third Party Advisory
• https://github.com/conda/conda-build/security/advisories/GHSA-6cc8-c3c9-3rgrExploit, Third Party Advisory

Published

Jun 16, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-32792SES safely executes third-party JavaScript 'strict' mode pro…8.7
• CVE-2025-32793Cilium is a networking, observability, and security solution…4
• CVE-2025-32794OpenEMR is a free and open source electronic health records …7.6
• CVE-2025-32795Dify is an open-source LLM app development platform. Prior t…6.5
• CVE-2025-32796Dify is an open-source LLM app development platform. Prior t…6.5
• CVE-2025-32797Conda-build contains commands and tools to build conda packa…7
• CVE-2025-32799Conda-build contains commands and tools to build conda packa…9.8
• CVE-2025-3280The ELEX WooCommerce Advanced Bulk Edit Products, Prices & A…6.5
• CVE-2025-32800Conda-build contains commands and tools to build conda packa…9.8
• CVE-2025-32801Kea configuration and API directives can be used to load a m…7.8
• CVE-2025-32802Kea configuration and API directives can be used to overwrit…6.1
• CVE-2025-32803In some cases, Kea log files or lease files may be world-rea…4