conda-forge conda-forge-ci-setup-feedstock up to 4.14.x eval RECIPE_DIR eval injection

Summaryinfo

A vulnerability, which was classified as critical, has been found in conda-forge conda-forge-ci-setup-feedstock up to 4.14.x. This affects the function eval. This manipulation of the argument RECIPE_DIR causes eval injection. This vulnerability appears as CVE-2025-49598. The attack requires local access. There is no available exploit. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability was found in conda-forge conda-forge-ci-setup-feedstock up to 4.14.x. It has been declared as critical. Affected by this vulnerability is the function eval. The manipulation of the argument RECIPE_DIR with an unknown input leads to a eval injection vulnerability. The CWE definition for the vulnerability is CWE-95. The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call (e.g. "eval"). As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

conda-forge-ci-setup is a package installed by conda-forge each time a build is run on CI. The conda-forge-ci-setup-feedstock setup script is vulnerable due to the unsafe use of the eval function when parsing version information from a custom-formatted meta.yaml file. An attacker controlling meta.yaml can inject malicious code into the version assignment, which is executed during file processing, leading to arbitrary code execution. Exploitation requires an attacker to modify the recipe file by manipulating the RECIPE_DIR variable and introducing a malicious meta.yaml file. While this is more feasible in CI/CD pipelines, it is uncommon in typical environments, reducing overall risk. This vulnerability is fixed in 4.15.0.

It is possible to read the advisory at github.com. This vulnerability is known as CVE-2025-49598 since 06/06/2025. The exploitation appears to be difficult. Attacking locally is a requirement. Technical details of the vulnerability are known, but there is no available exploit.

Upgrading to version 4.15.0 eliminates this vulnerability. Applying the patch fd91cb271c01f0e7928ebdc1feaac96fe385f959 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2025-18308). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• conda-forge

Name

• conda-forge-ci-setup-feedstock

Version

• 4.0
• 4.1
• 4.2
• 4.3
• 4.4
• 4.5
• 4.6
• 4.7
• 4.8
• 4.9
• 4.10
• 4.11
• 4.12
• 4.13
• 4.14

License

• open-source

Website

• Product: https://github.com/conda-forge/conda-forge-ci-setup-feedstock/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion