Back to Database
Status published
Critical
CVE-2025-27510
RCE in the package conda-forge-metadata
Vulnerability Description
conda-forge-metadata provides programatic access to conda-forge's metadata. conda-forge-metadata uses an optional dependency - "conda-oci-mirror" which was neither present on the PyPi repository nor registered by any entity. If conda-oci-mirror is taken over by a threat actor, it can result in remote code execution.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-27510
Credits & Attribution
No credits recorded in the NVD database.
References
More from conda-forge
View All →CVE-2025-49843
conda-smithy Has Incorrect Default File Permissions
Low
2.7
CVE-2025-49842
conda-forge-webservices Privilege Escalation Risk via Default Docker Root User
Low
1
CVE-2025-49824
conda-smithy Insecure Encryption Vulnerable to Oracle Padding Attack
Low
1.7
CVE-2025-49598
conda-forge-ci-setup Allows Arbitrary Code Execution via Insecure Version Parsing
Medium
4.4
CVE-2025-35471
conda-forge openssl-feedstock writable OPENSSLDIR
High
7
Affected Vendor
conda-forge
View all reports →Affected Software
conda-forge-metadata
Vulnerable Versions:
<= 0.4.1
Timeline
Official Publish:
March 4th, 2025
Last Modified:
March 5th, 2025
Added to House:
July 22nd, 2026
CVSS Vectors
Weaknesses (CWE)
MITRE ATT&CK TTPs
No associated TTPs found for this vulnerability.