CVE-2026-47425 in pixi
Summary
by MITRE • 07/21/2026
Rattler is a library that provides common functionality used within the conda ecosystem. Prior to version 0.43.2, `EntryPoint::FromStr` in `rattler_conda_types` performs only `.trim()` on the `command` field before the linker joins it onto the install prefix and writes an executable Python script. A malicious `noarch:python` package can ship an `info/link.json` with an entry-point name containing `..`, `/`, `\`, or an absolute path; the resulting file is written outside the prefix (or clobbers an existing in-prefix entry-point such as `bin/pip`) with mode `0o775` on Unix and a copied launcher `.exe` on Windows. This affects the default install path of `pixi install`, `mamba install` via py-rattler, `rattler-build`, and any other consumer of the `rattler` install crate; no flag or post-link-script opt-in is involved. Version 0.43.2 contains a fix for the issue.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/21/2026
The rattler library serves as a foundational component within the conda ecosystem, providing essential functionality for package management and installation operations. This vulnerability specifically targets the EntryPoint::FromStr implementation within the rattler_conda_types module, where insufficient input validation creates a critical security flaw that can be exploited by malicious actors. The vulnerability stems from the library's failure to properly sanitize entry-point commands during the parsing process, allowing attackers to manipulate file paths through carefully crafted input data.
The technical flaw manifests when processing noarch:python packages that contain specially crafted entry-point names in their info/link.json files. The system performs only basic string trimming operations on the command field without implementing proper path validation or sanitization measures. This allows malicious entry-point names containing directory traversal sequences such as "..", forward slashes "/", backslashes "\", or absolute paths to bypass normal security checks. When these malformed entry-point names are processed, they can cause the installation system to write executable files outside the intended installation prefix directory structure.
The operational impact of this vulnerability is significant across multiple conda ecosystem tools that rely on rattler's installation capabilities. The affected systems include pixi install, mamba install via py-rattler, rattler-build, and any other consumers of the rattler install crate. Attackers can leverage this flaw to write executable files with permissions set to 0o775 on Unix-like systems or create copied launcher .exe files on Windows systems. This privilege escalation allows malicious code execution outside the designated installation boundaries, potentially enabling arbitrary code execution, privilege escalation attacks, and system compromise.
The vulnerability demonstrates characteristics consistent with CWE-22 Path Traversal and CWE-73 Path Manipulation, where insufficient input validation leads to unauthorized file system access and modification. From an attack perspective, this aligns with ATT&CK techniques involving privilege escalation through malicious installation packages and execution of arbitrary code in protected environments. The flaw affects the core installation logic of conda package managers, making it particularly dangerous as it can be exploited by any user installing packages from untrusted sources without requiring additional opt-in mechanisms or specific flags.
The remediation implemented in version 0.43.2 addresses this vulnerability through proper input validation and sanitization of entry-point command fields. The fix ensures that malicious path traversal sequences are properly detected and rejected during the parsing phase, preventing the creation of executables outside the intended installation prefix. This update represents a critical security patch that restores the integrity of conda package installations across all affected tools and consumers of the rattler library ecosystem, protecting against unauthorized file system modifications and potential privilege escalation attacks.