Conda CVE-2026-53940

Requires the victim to install a malicious noarch:python Conda package (the vulnerable path is specific to noarch:python entry-point generation) whose info/link.json contains an entry-point command with path separators, traversal segments (e.g. '.'/'..'), or an absolute path. Exploitation occurs during a default conda install or environment transaction - no special non-default configuration is needed - but it demands user interaction (the user must initiate the install) and delivery of the crafted package, typically via an untrusted, malicious, or typosquatted channel. The out-of-prefix write variant additionally requires that the target parent directory already exists; the in-prefix entry-point overwrite variant has no such limit but only detonates when that entry point is later invoked. Code runs with the installing user's privileges (no privilege escalation beyond that).

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H = 8.8 HIGH) is credible but its severity hinges entirely on the UI:R and delivery model: exploitation is not a remote drive-by against a running Conda service - it requires a victim to install a malicious noarch:python package whose info/link.json carries a crafted entry-point command. There is no EPSS score, no CISA KEV listing, and no public POC referenced in the inputs, so this is 'no public exploit identified at time of analysis' rather than active exploitation. The confidentiality/integrity/availability all rated High reflect that a successful overwrite of an in-prefix entry point yields arbitrary Python execution with the installing user's privileges, which is a genuine code-execution outcome - so the high score is justified in impact terms, not inflated. The practical risk is gated by supply-chain trust: an attacker must get the target to install a poisoned package (e.g. from an untrusted or typosquatted channel). This is a real priority for anyone installing from untrusted Conda channels, but not a mass-exploitable network flaw. Note the AC:L is slightly optimistic for the out-of-prefix write variant, which the description says requires the target parent directory to already exist - the in-prefix entry-point overwrite variant, however, is reliable and needs no such precondition.

An attacker publishes or ships a malicious noarch:python Conda package whose info/link.json entry-point definition contains path-traversal segments, path separators, or an absolute path (e.g. a command that resolves outside bin/Scripts or overwrites an existing entry point). When a victim runs a normal conda install/environment transaction on that package, conda writes an executable wrapper to the attacker-chosen path; a subsequently invoked, overwritten entry point then executes attacker-controlled Python as the installing user. No public POC is referenced in the provided intelligence.