CLEANSTART-2026-DD95347: When tarfile or zipfile command line interface (CLI) is used to decompress an archive, a Python script shadowing the stdlib can be created
Security vulnerability affects the miniforge3 package. When tarfile or zipfile command line interface (CLI) is used to decompress an archive, a Python script shadowing the stdlib can be created.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
cleanstart/miniforge3to a version that resolves this vulnerability.Fixed in 26.3.2.3-r6
Frequently Asked Questions
Who is exposed to this issue?
Systems using the miniforge3 package are affected when the tarfile or zipfile command-line interface is used to decompress an archive. Exploitation requires local access, low privileges, and user interaction.
What conditions are required for exploitation?
An attacker must be able to cause or influence extraction of an archive through the tarfile or zipfile CLI, leading to creation of a Python script that shadows a standard-library module. The supplied severity vector indicates that user interaction is required.
Does the available information confirm that default installations are affected?
No. The provided information identifies the affected package and extraction scenario, but does not state whether the vulnerable CLI usage occurs in a default configuration.
How can I determine whether I may be affected?
Review whether miniforge3 environments use the tarfile or zipfile CLI to extract archives, and inspect extracted archive contents for Python scripts whose names could shadow Python standard-library modules. The provided data does not include affected or fixed version information.