CVE-2025-32798
Published: 16 June 2025
Summary
CVE-2025-32798 is a high-severity Code Injection (CWE-94) vulnerability in Anaconda Conda-Build. Its CVSS base score is 8.2 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Python (T1059.006); ranked in the top 20.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
Conda-build, a tool for building conda packages, is affected by CVE-2025-32798 prior to version 25.4.0. The vulnerability arises in the recipe processing logic that handles selectors embedded in meta.yaml files. It relies on Python's eval function to interpret these user-supplied expressions without sanitization, enabling arbitrary code execution during builds and violating the assumption that recipe content is trusted.
An attacker who can supply or influence a malicious meta.yaml file can trigger code execution in the build environment. Successful exploitation grants control over commands and file operations on the host, compromising confidentiality, integrity, and availability of the build process. The issue maps to CWE-94 and carries a CVSS 4.0 score of 8.2 with network attack vector and high impact metrics.
The official GitHub Security Advisory GHSA-6cc8-c3c9-3rgr and the associated commit document that the flaw was addressed by replacing unsafe eval usage with a safer selector parser in version 25.4.0. Users are advised to upgrade conda-build to the patched release to eliminate the execution pathway.
EPSS remains low and unchanged at 0.0121 with no observed rise after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-18460
Vulnerability details
Conda-build contains commands and tools to build conda packages. Prior to version 25.4.0, the conda-build recipe processing logic has been found to be vulnerable to arbitrary code execution due to unsafe evaluation of recipe selectors. Currently, conda-build uses the eval…
more
function to process embedded selectors in meta.yaml files. This approach evaluates user-defined expressions without proper sanitization, which allows arbitrary code to be executed during the build process. As a result, the integrity of the build environment is compromised, and unauthorized commands or file operations may be performed. The vulnerability stems from the inherent risk of using eval() on untrusted input in a context intended to control dynamic build configurations. By directly interpreting selector expressions, conda-build creates a potential execution pathway for malicious code, violating security assumptions. This issue has been patched in version 25.4.0.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Vulnerability enables arbitrary Python code execution via unsafe eval() of untrusted recipe selectors in conda-build, a trusted developer utility, facilitating Python interpreter abuse, proxy execution through developer tools, and client-side exploitation.
MITRE ATLAS TechniquesAI
MITRE ATLAS techniques
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Makes persistent code injection into loaded programs impossible when the executable image itself resides on hardware-protected read-only media.
Dynamically generated code can be produced and executed inside the isolated chamber, preventing host compromise from code-injection payloads.
Validates inputs used in dynamic code generation to block injected directives.
Directly prevents execution of attacker-supplied code written into data memory regions.