PYSEC-2026-2971

Vulnerability from pysec - Published: 2026-07-13 15:35 - Updated: 2026-07-13 16:05
VLAI
Details

Summary

EntryPoint::FromStr in rattler_conda_types performs only .trim() on the command field before the linker joins it onto the install prefix and writes an executable Python script. A malicious noarch:python package can ship an info/link.json with an entry-point name containing .., /, \, or an absolute path; the resulting file is written outside the prefix (or clobbers an existing in-prefix entry-point such as bin/pip) with mode 0o775 on Unix and a copied launcher .exe on Windows. This affects the default install path of pixi install, rattler-build, some methods in py-rattler, and any other consumer of the rattler install crate; no flag or post-link-script opt-in is involved.

Resolved in https://github.com/conda/rattler/pull/2445, released in rattler 0.43.2.

Affected

  • Repository: https://github.com/conda/rattler
  • Commit: a0e61a33da8b9d6de712fab2a879fa9da977e6e3 (HEAD at audit time, 2026-05-13 release)
  • Downstream consumers reached through the same code path: prefix-dev/pixi @ e640477
  • pixi 0.69.0 and rattler-build 0.65.0 fix this issue

Researcher

Berkant Koc me@berkoc.com PGP: 0C588DFD76204987284213EA0AC529C41F8AA5D6

Severity
6.3 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U
Impacted products
Name purl
py-rattler pkg:pypi/py-rattler
Aliases
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "py-rattler",
        "purl": "pkg:pypi/py-rattler"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.24.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.1.0",
        "0.1.1",
        "0.1.2",
        "0.10.0",
        "0.11.0",
        "0.12.0",
        "0.13.0",
        "0.13.1",
        "0.14.0",
        "0.15.0",
        "0.16.0",
        "0.17.0",
        "0.18.0",
        "0.19.0",
        "0.2.0",
        "0.2.1",
        "0.20.0",
        "0.21.0",
        "0.22.0",
        "0.23.0",
        "0.23.1",
        "0.23.2",
        "0.3.0",
        "0.4.0",
        "0.5.0",
        "0.6.0",
        "0.6.1",
        "0.6.2",
        "0.6.3",
        "0.7.0",
        "0.7.1",
        "0.7.2",
        "0.8.0",
        "0.8.2",
        "0.9.0",
        "0.9.1"
      ]
    }
  ],
  "aliases": [
    "CVE-2026-47425",
    "GHSA-q53q-5r4j-5729"
  ],
  "details": "## Summary\n\n`EntryPoint::FromStr` in `rattler_conda_types` performs only `.trim()` on the `command` field before the linker joins it onto the install prefix and writes an executable Python script. A malicious `noarch:python` package can ship an `info/link.json` with an entry-point name containing `..`, `/`, `\\`, or an absolute path; the resulting file is written outside the prefix (or clobbers an existing in-prefix entry-point such as `bin/pip`) with mode `0o775` on Unix and a copied launcher `.exe` on Windows. This affects the default install path of `pixi install`, `rattler-build`, some methods in `py-rattler`, and any other consumer of the `rattler` install crate; no flag or post-link-script opt-in is involved.\n\nResolved in https://github.com/conda/rattler/pull/2445, released in rattler 0.43.2.\n\n## Affected\n\n- Repository: https://github.com/conda/rattler\n- Commit: `a0e61a33da8b9d6de712fab2a879fa9da977e6e3` (HEAD at audit time, 2026-05-13 release)\n- Downstream consumers reached through the same code path: `prefix-dev/pixi` @ `e640477`\n- pixi 0.69.0 and rattler-build 0.65.0 fix this issue\n\n## Researcher\n\nBerkant Koc \u003cme@berkoc.com\u003e\nPGP: 0C588DFD76204987284213EA0AC529C41F8AA5D6",
  "id": "PYSEC-2026-2971",
  "modified": "2026-07-13T16:05:50.127320Z",
  "published": "2026-07-13T15:35:23.329275Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/conda/rattler/security/advisories/GHSA-q53q-5r4j-5729"
    },
    {
      "type": "WEB",
      "url": "https://github.com/conda/rattler/pull/2445"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/conda/rattler"
    },
    {
      "type": "PACKAGE",
      "url": "https://pypi.org/project/py-rattler"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-q53q-5r4j-5729"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-47425"
    }
  ],
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U",
      "type": "CVSS_V4"
    }
  ],
  "summary": "rattler has an entry-point path traversal in noarch:python install (arbitrary file write)"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.