Anaconda

10 CVEs across 3 Anaconda products. Browse Anaconda vulnerabilities, severities, and proof-of-concept exploits.

Anaconda products with known CVEs

ProductCVEs
Anaconda34
Conda-Build4
Dask2
Anaconda CVEs — newest first
CVESeverityScorePublishedSummary
CVE-2026-23528Medium6.12026-01-16Dask distributed is a distributed task scheduler for Dask. Prior to 2026.1.0, when Jupyter Lab, jupyter-server-proxy, and Dask distributed are all run together…
CVE-2024-46060High7.82025-12-17Anaconda3 macOS installers before 2024.06-1 contain a local privilege escalation vulnerability when installed outside the user's home directory. During install…
CVE-2025-32800Critical9.82025-06-16Conda-build contains commands and tools to build conda packages. Prior to version 25.3.0, the pyproject.toml lists conda-index as a Python dependency. This pac…
CVE-2025-32799Critical9.82025-06-16Conda-build contains commands and tools to build conda packages. Prior to version 25.4.0, the conda-build processing logic is vulnerable to path traversal (Tar…
CVE-2025-32798Critical9.82025-06-16Conda-build contains commands and tools to build conda packages. Prior to version 25.4.0, the conda-build recipe processing logic has been found to be vulnerab…
CVE-2025-32797High7.02025-06-16Conda-build contains commands and tools to build conda packages. Prior to version 25.3.1, the write_build_scripts function in conda-build creates the temporary…
CVE-2023-35845Medium4.72023-09-11Anaconda 3 2023.03-1-Linux allows local users to disrupt TLS certificate validation by modifying the cacert.pem file used by the installed pip program. This oc…
CVE-2021-42969High8.82022-05-13Certain Anaconda3 2021.05 are affected by OS command injection. When a user installs Anaconda, an attacker can create a new file and write something in usercus…
CVE-2022-26526High7.82022-03-17Anaconda Anaconda3 (Anaconda Distribution) through 2021.11.0.0 and Miniconda3 through 4.11.0.0 can create a world-writable directory under %PROGRAMDATA% and pl…
CVE-2021-42343Critical9.82021-10-26An issue was discovered in the Dask distributed package before 2021.10.0 for Python. Single machine Dask clusters started with dask.distributed.LocalCluster or…