CVE-2025-32800 - CVE House
Back to Database
Status published High CVE-2025-32800

Conda-build vulnerable to supply chain attack vector due to pyproject.toml referring to dependencies not present in PyPI

Vulnerability Description

Conda-build contains commands and tools to build conda packages. Prior to version 25.3.0, the pyproject.toml lists conda-index as a Python dependency. This package is not published in PyPI. An attacker could claim this namespace and upload arbitrary (malicious) code to the package, and then exploit pip install commands by injecting the malicious dependency in the solve. This issue has been fixed in version 25.3.0. A workaround involves using --no-deps for pip install-ing the project from the repository.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-32800

Credits & Attribution

No credits recorded in the NVD database.

References

More from conda

View All →
CVE-2025-64343
(conda) Constructor: Excessive permissions during and after installation
High 7.8
CVE-2025-49823
Conda Constructor Command Injection via Unsanitized User Input (Low)
Unknown 0
CVE-2025-32799
Conda-build Vulnerable to Path Traversal via Malicious Tar File
Medium 5.6
CVE-2025-32798
Conda-build Allows Arbitrary Code Execution via Malicious Recipe Selectors
High 8.2
CVE-2025-32797
Conda-build Insecure Build Script Permissions Enabling Arbitrary Code Execution
Medium 6

Affected Vendor

Affected Software

conda-build
Vulnerable Versions:
< 25.3.0

Timeline

Official Publish: June 16th, 2025
Last Modified: June 17th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

CWE-1357

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.