CVE-2025-27510: RCE in the package conda-forge-metadata
First published: Tue Mar 04 2025(Updated: )
conda-forge-metadata provides programatic access to conda-forge's metadata. conda-forge-metadata uses an optional dependency - "conda-oci-mirror" which was neither present on the PyPi repository nor registered by any entity. If conda-oci-mirror is taken over by a threat actor, it can result in remote code execution.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| conda-forge-metadata |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2025-27510?
CVE-2025-27510 is categorized as a severity risk due to the potential takeover of the 'conda-oci-mirror' dependency.
How do I fix CVE-2025-27510?
To mitigate CVE-2025-27510, ensure that 'conda-oci-mirror' is not being used or monitored closely for unauthorized changes.
What impact does CVE-2025-27510 have on conda-forge-metadata users?
Users of conda-forge-metadata could be at risk of malicious activity if the optional 'conda-oci-mirror' dependency is compromised.
Is 'conda-oci-mirror' officially recognized in any repositories related to CVE-2025-27510?
No, 'conda-oci-mirror' is not present on the PyPi repository or officially registered, which heightens its risk.
Who should be concerned about CVE-2025-27510?
Developers and organizations using conda-forge-metadata should be particularly vigilant regarding CVE-2025-27510.
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/title
- agent/references
- agent/description
- agent/first-publish-date
- agent/type
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- agent/softwarecombine
- collector/nvd-api
- source/NVD
- agent/last-modified-date
- agent/severity
- agent/author
- agent/event
- collector/epss-latest
- source/FIRST
- agent/source
- agent/tags
- agent/epss
- vendor/conda-forge
- canonical/conda-forge-metadata