EUVD-2026-75141
GHSA-h672-p7h7-97v9
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
Network vector fits malicious channel delivery; PR:N for the attacker (channel operator); UI:R because victim must actively install from the untrusted channel; no confidentiality impact described.
Primary rating from Vendor (https://github.com/conda/rattler).
CVSS VectorVendor: https://github.com/conda/rattler
Lifecycle Timeline
1Blast Radius
ecosystem impact- 3 pypi packages depend on py-rattler (3 direct, 0 indirect)
Ecosystem-wide dependent count for version 0.24.0.
DescriptionCVE.org
rattler_cache and py-rattler were vulnerable to package-cache path traversal when handling package metadata from conda channels.
During cache materialization, the ratter_cache code used the package record build string as part of a cache key that was joined into a filesystem path. A malicious or untrusted channel could publish repodata with path separators or traversal components in that field, causing package contents to be written outside the configured package cache directory.
The issue requires use of a malicious or otherwise untrusted conda channel. Curated channels that validate package metadata are not expected to allow malformed build strings of this form.
Users should upgrade to a patched version and avoid untrusted conda channels.
AnalysisAI
Path traversal in rattler_cache and py-rattler exposes the victim's filesystem to out-of-bounds file writes when package metadata from an untrusted conda channel contains path separators or directory traversal sequences in the build string. Users who install packages from a malicious channel trigger cache materialization logic that joins the unsanitized build string into a filesystem path, allowing package contents to land outside the configured cache directory. No public exploit has been identified and no CISA KEV listing exists; exploitation requires deliberate use of an untrusted channel (CVSS UI:R), meaningfully limiting real-world exposure.
Technical ContextAI
rattler_cache is a Rust crate (pkg:rust/rattler_cache) and py-rattler is its Python binding (pkg:pip/py_rattler), both part of the conda/rattler ecosystem used for resolving, fetching, and caching conda packages. During cache materialization, the code constructs a filesystem path by joining the package record's build string as a cache key component. CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) applies directly: the build field is incorporated into the path without stripping path separator characters or traversal sequences such as '../', allowing an attacker-controlled string to escape the cache root. The vulnerability lives at the interface between conda channel repodata (JSON metadata served by a channel) and the local cache write logic, not in package archive extraction itself.
RemediationAI
Upgrade rattler_cache and py-rattler to the patched version as documented in the GitHub Security Advisory GHSA-h672-p7h7-97v9 (https://github.com/conda/rattler/security/advisories/GHSA-h672-p7h7-97v9). Exact patched version numbers are not independently confirmed from available data - verify the specific target version against the advisory before deploying. As an immediate compensating control, restrict conda channel configuration exclusively to validated, curated sources such as conda-forge or the official Anaconda channel; this eliminates the attack surface entirely because curated channels are not expected to permit malformed build strings. Removing or disabling untrusted channels has no functional downside for users relying on standard package sources.
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today