CLEANSTART-2026-EH16776: Security fix for GHSA-xmj3-9gf7-h52w applied in: miniforge3 25.11.0.1-r6, miniforge3 26.1.1.3-r4
Security vulnerability affects the miniforge3 package. This issue is resolved in later releases. See references for vulnerability details.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
cleanstart/miniforge3to a version that resolves this vulnerability.Fixed in 25.11.0.1-r6 - Upgrade
Upgrade
cleanstart/miniforge3to a version that resolves this vulnerability.Fixed in 26.1.1.3-r4 - Upgrade
Upgrade
miniforge3to a version that resolves this vulnerability.Fixed in 25.11.0.1-r6 - Upgrade
Upgrade
miniforge3to a version that resolves this vulnerability.Fixed in 26.1.1.3-r4
Frequently Asked Questions
Which miniforge3 package releases contain the security fix?
The fix is applied in miniforge3 25.11.0.1-r6 and 26.1.1.3-r4. Later releases are also described as resolved.
What access and conditions are required for exploitation?
The supplied vector indicates an attacker needs local access, low privileges, user interaction, and additional attack-specific conditions. The issue has low severity and does not affect confidentiality according to the provided impact vector.
How can I determine whether my installation is affected?
Check the installed cleanstart/miniforge3 package version. Systems not running 25.11.0.1-r6, 26.1.1.3-r4, or a later resolved release should be evaluated for upgrade.