CVE-2025-49823 json
Conda Constructor Command Injection via Unsanitized User Input (Low)
published 2025-06-17 16 mo ago modified 2026-06-17 4 mo ago also EUVD-2025-18445
- cvss
- 0.0
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.2%
- EPSS 0.2% chance of exploitation in 30 days, percentile 5%
- public exploits
- 0
- none known
Summary
(conda) Constructor is a tool which allows constructing an installer for a collection of conda packages. Prior to version 3.11.3, shell installer scripts process the installation prefix (user_prefix) using an eval statement, which executes unsanitized user input as shell code. Although the script runs with user privileges (not root), an attacker could exploit this by injecting arbitrary commands through a malicious path during installation. Exploitation requires explicit user action. This issue has been patched in version 3.11.3.
Patch / fix
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 16 mo ago
Exploit prediction
0.16% chance of exploitation in the next 30 days, higher than 5% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 0.0 | CVSS:3.1/AV:P/AC:H/PR:H/UI:R/S:C/C:N/I:N/A:N |
Affected products
- conda constructor
Classification
- Weakness
-
- CWE-77 Improper Neutralization of Special Elements used in a Command
References
Sources
- CVE List CVE-2025-49823
- NVD CVE-2025-49823
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.