« Volver al listado

CVE-2025-49823

Estado: AplazadaNinguna (0)—

(conda) Constructor is a tool which allows constructing an installer for a collection of conda packages. Prior to version 3.11.3, shell installer scripts process the installation prefix (user_prefix) using an eval statement, which executes unsanitized user input as shell code. Although the script runs with user privileges (not root), an attacker could exploit this by injecting arbitrary commands through a malicious path during installation. Exploitation requires explicit user action. This issue has been patched in version 3.11.3.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Conda — ConstructorAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-49823",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-49823",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-06-17T15:51:15.900223Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 0,
          "attackVector": "PHYSICAL",
          "baseSeverity": "NONE",
          "vectorString": "CVSS:3.1/AV:P/AC:H/PR:H/UI:R/S:C/C:N/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "REQUIRED",
          "attackComplexity": "HIGH",
          "availabilityImpact": "NONE",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 0,
        "exploitabilityScore": 0.2
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "conda",
          "product": "constructor",
          "versions": [
            {
              "status": "affected",
              "version": "< 3.11.3"
            }
          ]
        }
      ]
    }
  ],
  "published": "2025-06-17T03:15:24.580",
  "references": [
    {
      "url": "https://github.com/conda/constructor/commit/ce4c2d58cfcde2f62d038fb8aba013176c77a0b1",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/conda/constructor/security/advisories/GHSA-44q9-rg2q-5g99",
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-77"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "(conda) Constructor is a tool which allows constructing an installer for a collection of conda packages. Prior to version 3.11.3, shell installer scripts process the installation prefix (user_prefix) using an eval statement, which executes unsanitized user input as shell code. Although the script runs with user privileges (not root), an attacker could exploit this by injecting arbitrary commands through a malicious path during installation. Exploitation requires explicit user action. This issue has been patched in version 3.11.3."
    },
    {
      "lang": "es",
      "value": "(conda) Constructor es una herramienta que permite construir un instalador para una colección de paquetes conda. Antes de la versión 3.11.3, los scripts de instalación de shell procesaban el prefijo de instalación (user_prefix) mediante una sentencia eval, que ejecutaba la entrada de usuario no autorizada como código de shell. Aunque el script se ejecuta con privilegios de usuario (no root), un atacante podría aprovechar esto inyectando comandos arbitrarios a través de una ruta maliciosa durante la instalación. La explotación requiere una acción explícita del usuario. Este problema se ha corregido en la versión 3.11.3."
    }
  ],
  "lastModified": "2026-06-17T09:31:57.353",
  "sourceIdentifier": "security-advisories@github.com"
}