CVE-2025-32800: Conda-build vulnerable to supply chain attack vector due to pyproject.toml referring to dependencies not present in PyPI
Conda-build contains commands and tools to build conda packages. Prior to version 25.3.0, the pyproject.toml lists conda-index as a Python dependency. This package is not published in PyPI. An attacker could claim this namespace and upload arbitrary (malicious) code to the package, and then exploit pip install commands by injecting the malicious dependency in the solve. This issue has been fixed in version 25.3.0. A workaround involves using --no-deps for pip install-ing the project from the repository.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-32800?
CVE-2025-32800 is considered a medium severity vulnerability due to the potential for malicious code execution through the conda-index dependency.
How do I fix CVE-2025-32800?
To fix CVE-2025-32800, update conda-build to version 25.3.0 or later to eliminate the dependency on the unregistered conda-index package.
Who is affected by CVE-2025-32800?
Users of Anaconda conda-build prior to version 25.3.0 are affected by CVE-2025-32800.
What does CVE-2025-32800 involve?
CVE-2025-32800 involves a vulnerability where an unregistered package dependency could allow for the injection of malicious code during conda package builds.
Is there any public exploit for CVE-2025-32800?
As of now, there are no known public exploits specifically targeting CVE-2025-32800.