{"id":"CVE-2026-53940","title":"Conda is a system-level binary package and environment manager that runs on major operating systems and platforms","summary":"Conda is a system-level binary package and environment manager that runs on major operating systems and platforms. Prior to 26.5.2, parse_entry_point_def in conda/common/path/python.py accepted an unvalidated entry-point command from a n…","severity":"high","cvss":8.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":["CWE-22","CWE-73"],"vendor":"conda","product":"conda","affected":["conda < 26.5.2"],"published":"2026-09-21","updated":"2026-09-21","sourceUpdated":"2026-09-21T19:17:06.670","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-53940","references":[{"url":"https://github.com/conda/conda/commit/3987c86ccd5527177e96b48bd4dc1777dd2c9baa","label":"security-advisories@github.com"},{"url":"https://github.com/conda/conda/pull/16168","label":"security-advisories@github.com"},{"url":"https://github.com/conda/conda/releases/tag/26.5.2","label":"security-advisories@github.com"},{"url":"https://github.com/conda/conda/security/advisories/GHSA-9m8m-c4j3-rj2c","label":"security-advisories@github.com"},{"url":"https://github.com/conda/conda/security/advisories/GHSA-9m8m-c4j3-rj2c","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"tags":["nvd","cve.org","exploit-available"],"exploitAvailable":true,"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"total","timestamp":"2026-09-21T18:46:47.887956Z"},"ingestedAt":"2026-09-21T16:11:47.449Z","slug":"CVE-2026-53940","body":"## Overview\n\nConda is a system-level binary package and environment manager that runs on major operating systems and platforms. Prior to 26.5.2, parse_entry_point_def in conda/common/path/python.py accepted an unvalidated entry-point command from a noarch:python package's info/link.json metadata. CreatePythonEntryPointAction in conda/core/path_actions.py interpolated that command into target_short_path, and PrefixPathAction.target_full_path joined it to the installation prefix without verifying that the result remained under the intended bin or Scripts directory. create_python_entry_point in conda/gateways/disk/create.py then wrote an executable wrapper to the resulting path. A malicious package could use path separators, traversal segments, or an absolute command path to write outside the prefix or overwrite another in-prefix entry point during default install and environment transactions. Out-of-prefix writes require the target parent directory to exist, while an overwritten entry point can execute attacker-controlled Python when later invoked with the installing user's privileges. This issue is fixed in version 26.5.2.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"midnight","depthScore":60,"depthScoreParts":{"impact":48.4,"likelihood":0,"exploitation":12,"ransomware":0},"changes":[{"seq":208756,"id":"CVE-2026-53940","ts":1790020358573,"field":"exploit_available","old":"false","new":"true"}]}