CLEANSTART-2026-WT88478: When passing data to the b64decode(), standard_b64decode(), and urlsafe_b64decode() functions in the "base64" module the characters "+/" will always be accepted, regardless of the value of "altchar...
Security vulnerability affects the miniforge3 package. When passing data to the b64decode(), standardb64decode(), and urlsafeb64decode() functions in the "base64" module the characters "+/" will always be accepted, regardless of the value of "altchars" parameter, typically used to establish an "alternative base64 alphabet" such as the URL safe alph....
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
cleanstart/miniforge3to a version that resolves this vulnerability.Fixed in 25.11.0.1-r6 - Upgrade
Upgrade
cleanstart/miniforge3to a version that resolves this vulnerability.Fixed in 26.1.1.3-r4 - Upgrade
Upgrade
cleanstart/miniforge3to a version that resolves this vulnerability.Fixed in 26.3.2.3-r6
Frequently Asked Questions
Which deployments are realistically exposed?
Applications using the affected miniforge3 package are exposed when they decode attacker-controlled Base64 input and rely on an alternative alphabet, such as a URL-safe alphabet, to reject the standard "+" and "/" characters.
What does an attacker need to exploit this behavior?
An attacker needs to supply Base64-encoded input to code that calls b64decode(), standard_b64decode(), or urlsafe_b64decode() and expects its altchars setting to enforce rejection of "+" and "/".
Can an alternative Base64 alphabet be relied on to block standard Base64 characters?
No. The affected decoding functions accept "+" and "/" regardless of the altchars value, so an application must not treat altchars as an input-validation boundary for those characters.