CLEANSTART-2026-OX17353: poplib module, when passed a user-controlled command, can have additional commands injected using newlines
Security vulnerability affects the miniforge3 package. The poplib module, when passed a user-controlled command, can have additional commands injected using newlines.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
cleanstart/miniforge3to a version that resolves this vulnerability.Fixed in 25.11.0.1-r6 - Upgrade
Upgrade
cleanstart/miniforge3to a version that resolves this vulnerability.Fixed in 26.1.1.3-r4 - Upgrade
Upgrade
cleanstart/miniforge3to a version that resolves this vulnerability.Fixed in 26.3.2.3-r6
Frequently Asked Questions
Who is realistically exposed to this issue?
Deployments are exposed when software using the affected poplib module passes attacker-controlled input into a command. The attack vector is network-based, and the CVSS vector indicates that high privileges are required.
What does an attacker need to exploit it?
The attacker needs a way to influence a command passed to poplib and include newline characters in that input. The CVSS vector rates attack complexity as low, but also indicates a prerequisite attack condition and high required privileges.
What can be done before a patch is available?
Avoid passing user-controlled values as poplib commands. Validate or reject newline characters in any input that could reach such a command.
How can I assess whether my deployment is affected?
Identify uses of the poplib module in the miniforge3 package and determine whether command values can be influenced by users or other untrusted sources. Inputs that can contain newlines are the relevant risk condition.