Path Traversal in Conda Py-rattler
CVE-2026-47425
Rattler is a library that provides common functionality used within the conda ecosystem. Prior to version 0.43.2, `EntryPoint::FromStr` in `rattler_conda_types` performs only `.trim()` on the `command` field before the linker joins it onto…
Vulnerability class: Path Traversal (Directory Traversal)
Affected products
- Conda Py-rattler — versions < 0.24.0
- Conda Rattler — versions < 0.43.2
- Conda Rattler-build — versions < 0.65.0
- Prefix-dev Pixi — versions < 0.69.0
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_MISC)
- security-advisories@github.com (x_refsource_CONFIRM)