CVE-2025-27510

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2025-27510

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-27510.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2025-27510

Aliases

GHSA-vwfh-m3q7-9jpw

Published

2025-03-04T21:48:12.688Z

Modified

2026-04-02T12:46:05.344293Z

Severity

9.3 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator

Summary

RCE in the package conda-forge-metadata

Details

conda-forge-metadata provides programatic access to conda-forge's metadata. conda-forge-metadata uses an optional dependency - "conda-oci-mirror" which was neither present on the PyPi repository nor registered by any entity. If conda-oci-mirror is taken over by a threat actor, it can result in remote code execution.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/27xxx/CVE-2025-27510.json",
    "cwe_ids": [
        "CWE-829"
    ],
    "cna_assigner": "GitHub_M"
}

References

Affected packages

Git / github.com/conda-forge/conda-forge-metadata

Affected ranges

Type

GIT

Repo

https://github.com/conda-forge/conda-forge-metadata

Events

Introduced

Last affected

542a959f6c6c06028cb222094d9a523b96c721c4

Database specific

{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "0.4.1"
        }
    ]
}

Affected versions

0.*

0.1.0

0.2.0

0.3.0

0.4.0

0.4.1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-27510.json"