CVE-2025-27510: RCE in the package conda-forge-metadata
conda-forge-metadata provides programatic access to conda-forge's metadata. conda-forge-metadata uses an optional dependency - "conda-oci-mirror" which was neither present on the PyPi repository nor registered by any entity. If conda-oci-mirror is taken over by a threat actor, it can result in remote code execution.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-27510?
CVE-2025-27510 is categorized as a severity risk due to the potential takeover of the 'conda-oci-mirror' dependency.
How do I fix CVE-2025-27510?
To mitigate CVE-2025-27510, ensure that 'conda-oci-mirror' is not being used or monitored closely for unauthorized changes.
What impact does CVE-2025-27510 have on conda-forge-metadata users?
Users of conda-forge-metadata could be at risk of malicious activity if the optional 'conda-oci-mirror' dependency is compromised.
Is 'conda-oci-mirror' officially recognized in any repositories related to CVE-2025-27510?
No, 'conda-oci-mirror' is not present on the PyPi repository or officially registered, which heightens its risk.
Who should be concerned about CVE-2025-27510?
Developers and organizations using conda-forge-metadata should be particularly vigilant regarding CVE-2025-27510.