RCE in Conda Constructor
CVE-2025-49823
(conda) Constructor is a tool which allows constructing an installer for a collection of conda packages. Prior to version 3.11.3, shell installer scripts process the installation prefix (user_prefix) using an eval statement, which executes unsanitized user input as shell code. Although the script runs with user privileges (not root), an attacker could exploit this by injecting arbitrary commands through a malicious path during installation. Exploitation requires explicit user action. This issue has been patched in version 3.11.3.
Vulnerability class: Command Injection (OS Command Injection)
EPSS: 0.001 (3.8th percentile) — read the EPSS interpretation.
Affected products
- Conda Constructor — versions < 3.11.3
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security-advisories@github.com (x_refsource_CONFIRM)
- security-advisories@github.com (x_refsource_MISC)
Frequently asked questions
- What is CVE-2025-49823?
- CVE-2025-49823 is a vulnerability in Conda Constructor, classified under Command Injection. Published 2025-06-17.
- Is CVE-2025-49823 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.