CVE-2026-53940

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-53940
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-53940.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-53940
Aliases
  • GHSA-9m8m-c4j3-rj2c
Downstream
Published
2026-09-21T15:35:37Z
Modified
2026-09-23T03:45:15Z
Severity
  • 8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVSS Calculator
Summary
Conda: Entry-point path traversal in noarch:python install (arbitrary file write) — canonical Python implementation
Details

Conda is a system-level binary package and environment manager that runs on major operating systems and platforms. Prior to 26.5.2, parse_entry_point_def in conda/common/path/python.py accepted an unvalidated entry-point command from a noarch:python package's info/link.json metadata. CreatePythonEntryPointAction in conda/core/path_actions.py interpolated that command into target_short_path, and PrefixPathAction.target_full_path joined it to the installation prefix without verifying that the result remained under the intended bin or Scripts directory. create_python_entry_point in conda/gateways/disk/create.py then wrote an executable wrapper to the resulting path. A malicious package could use path separators, traversal segments, or an absolute command path to write outside the prefix or overwrite another in-prefix entry point during default install and environment transactions. Out-of-prefix writes require the target parent directory to exist, while an overwritten entry point can execute attacker-controlled Python when later invoked with the installing user's privileges. This issue is fixed in version 26.5.2.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-22",
        "CWE-73"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53940.json"
}
References

Affected packages

Git / github.com/conda/conda

Affected ranges

Type
GIT
Repo
https://github.com/conda/conda
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
3987c86ccd5527177e96b48bd4dc1777dd2c9baa
Fixed
90559068eeea050c706ceea7fdefadd6ea6a1ebc
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "26.5.2"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

1.*
1.1.0
1.2.0
1.2.1
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
1.3.5
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.5.0
1.5.2
1.6.0
1.6.0rc1
1.6.0rc2
1.7.0
1.7.1
1.7.2
1.8.0
1.8.1
1.8.2
1.9.0
1.9.1
2.*
2.0.0
2.0.1
2.0.2
2.0.3
2.0.4
2.1.0
2.2.0
2.2.1
2.2.2
2.2.8
2.3.0
2.3.1
22.*
22.11.0
22.11.1
22.9.0
23.*
23.1.0
23.3.0
23.3.1
26.*
26.3.0
26.5.0
26.5.1
3.*
3.0.1
3.0.2
3.0.3
3.0.5
3.0.6
3.1.0
3.11.0
3.12.0
3.14.0
3.14.1
3.15.1
3.16.0
3.18.0
3.18.1
3.18.2
3.18.3
3.18.4
3.18.5
3.18.6
3.18.7
3.18.8
3.18.9
3.19.0
3.19.1
3.2.0
3.2.0a1
3.2.1
3.3.0
3.3.1
3.3.2
3.4.0
3.4.1
3.4.2
3.4.3
3.5.0
3.5.1
3.5.2
3.5.4
3.6.0
3.6.2
3.7.0
3.7.1
3.7.2
3.7.3
3.7.4
3.8.0
3.8.1
3.8.2
3.8.3
3.8.4
3.9.0
3.9.1
4.*
4.0.0
4.0.1
4.0.2
4.1.0
4.1.1
4.1.2
4.1.3
4.10.0
4.10.1
4.10.2
4.10.3
4.11.0
4.12.0
4.13.0
4.14.0
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.3.0
4.3.1
4.3.2
4.3.3
4.5.0
4.5.0rc0
4.6.0
4.6.0a1
4.6.0a2
4.6.0b0
4.6.0b1
4.6.0rc1
4.6.1
4.6.10
4.6.11
4.6.12
4.6.13
4.6.14
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.6.9
4.7.0
4.7.1
4.7.10
4.7.11
4.7.12
4.7.2
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.7.8
4.7.9
4.8.0
4.8.0rc0
4.8.1
4.8.2
4.8.3
4.9.0
4.9.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-53940.json"