CVE-2025-27510 RCE in the package conda-forge-metadata
Attackers can achieve remote code execution by compromising the unregistered optional dependency conda-oci-mirror used by conda-forge-metadata.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-27510?
CVE-2025-27510 is a critical vulnerability in conda-forge-metadata, published on 4 Mar 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
conda-forge-metadata provides programatic access to conda-forge's metadata. conda-forge-metadata uses an optional dependency - "conda-oci-mirror" which was neither present on the PyPi repository nor registered by any entity. If conda-oci-mirror is taken over by a threat actor, it can result in remote code execution.
Weakness: CWE-829
Which versions are affected by CVE-2025-27510?
How do I fix CVE-2025-27510?
No fix has been published for CVE-2025-27510 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-27510 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-27510 exists.
Sources
Also known as GHSA-vwfh-m3q7-9jpw.