conda has 3 CVEs on record. 3 were published in the last 90 days. The median CVSS is 8.8 (high), with 1 rated critical.
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 8.8
- Publish → KEV
- —
- Last 90 days
- 3 prev 0
Worst active — by depth score
CVE-2026-53940High· 8.8Conda is a system-level binary package and environment manager that runs on major operating systems and platforms61CVE-2026-53942Critical· 9.9Conda Organization Infrastructure: Pwn Request in update workflow allows PR-controlled template rendering with SYNC_TOKEN55CVE-2026-53956Medium· 5.4Rattler vulnerable to package cache path traversal via conda package build string30
conda vulnerabilities
CVEs affecting conda, newest first. Open any entry for full detail, references, and exploit status.
3 CVEsRSS
CVE-2026-53942Critical· 9.9Conda Organization Infrastructure: Pwn Request in update workflow allows PR-controlled template rendering with SYNC_TOKEN
Conda Organization Infrastructure is a centralized location for infrastructure codes. Prior to commit 9c0f238, a GitHub Actions Pwn Request vulnerability appears to remain present in conda/conda. The affected workflow is .github/workflow…
CVE-2026-53940High· 8.8PoCConda is a system-level binary package and environment manager that runs on major operating systems and platforms
Conda is a system-level binary package and environment manager that runs on major operating systems and platforms. Prior to 26.5.2, parse_entry_point_def in conda/common/path/python.py accepted an unvalidated entry-point command from a n…
CVE-2026-53956Medium· 5.4Rattler vulnerable to package cache path traversal via conda package build string
Rattler is a library that provides common functionality used within the conda ecosystem. `rattler_cache` prior to version 0.9.0 and `py-rattler` prior to version 0.24.0 were vulnerable to package-cache path traversal when handling packag…