What is CVE-2025-32798?

CVE-2025-32798 is a critical-severity vulnerability in Anaconda Conda-build, classified under Code Injection. CVSS score: 9.8/10. Published 2025-06-16.

How severe is CVE-2025-32798?

Critical severity. CVSS v3 base score is 9.8 out of 10.

RCE in Anaconda Conda-build

CVE-2025-32798

Conda-build contains commands and tools to build conda packages. Prior to version 25.4.0, the conda-build recipe processing logic has been found to be vulnerable to arbitrary code execution due to unsafe evaluation of recipe selectors. Cur…

Vulnerability class: RCE (Remote Code Execution)

EPSS: 0.007 (48.3th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Anaconda Conda-build
Conda Conda-build — versions < 25.4.0

Weakness classification (CWE)

CWE-94 — Code Injection

References

security-advisories@github.com (x_refsource_CONFIRM, Exploit, Third Party Advisory)
security-advisories@github.com (Patch, x_refsource_MISC)
security-advisories@github.com (Product, x_refsource_MISC)

Frequently asked questions

What is CVE-2025-32798?: CVE-2025-32798 is a critical-severity vulnerability in Anaconda Conda-build, classified under Code Injection. CVSS score: 9.8/10. Published 2025-06-16.
How severe is CVE-2025-32798?: Critical severity. CVSS v3 base score is 9.8 out of 10.