{"id":"CVE-2026-53940","summary":"Conda: Entry-point path traversal in noarch:python install (arbitrary file write) — canonical Python implementation","details":"Conda is a system-level binary package and environment manager that runs on major operating systems and platforms. Prior to 26.5.2, parse_entry_point_def in conda/common/path/python.py accepted an unvalidated entry-point command from a noarch:python package's info/link.json metadata. CreatePythonEntryPointAction in conda/core/path_actions.py interpolated that command into target_short_path, and PrefixPathAction.target_full_path joined it to the installation prefix without verifying that the result remained under the intended bin or Scripts directory. create_python_entry_point in conda/gateways/disk/create.py then wrote an executable wrapper to the resulting path. A malicious package could use path separators, traversal segments, or an absolute command path to write outside the prefix or overwrite another in-prefix entry point during default install and environment transactions. Out-of-prefix writes require the target parent directory to exist, while an overwritten entry point can execute attacker-controlled Python when later invoked with the installing user's privileges. This issue is fixed in version 26.5.2.","aliases":["GHSA-9m8m-c4j3-rj2c"],"modified":"2026-09-23T03:45:15.155820349Z","published":"2026-09-21T15:35:37.770Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-22","CWE-73"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53940.json"},"references":[{"type":"WEB","url":"https://github.com/conda/conda/releases/tag/26.5.2"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53940.json"},{"type":"ADVISORY","url":"https://github.com/conda/conda/security/advisories/GHSA-9m8m-c4j3-rj2c"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53940"},{"type":"FIX","url":"https://github.com/conda/conda/commit/3987c86ccd5527177e96b48bd4dc1777dd2c9baa"},{"type":"FIX","url":"https://github.com/conda/conda/pull/16168"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/conda/conda","events":[{"introduced":"0"},{"fixed":"3987c86ccd5527177e96b48bd4dc1777dd2c9baa"},{"fixed":"90559068eeea050c706ceea7fdefadd6ea6a1ebc"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"26.5.2"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["26.5.1","26.5.0","26.3.0","23.3.1","23.3.0","23.1.0","22.11.1","22.11.0","22.9.0","4.14.0","4.13.0","4.12.0","4.11.0","4.10.3","4.10.2","4.10.1","4.10.0","4.9.1","4.9.0","4.8.3","4.8.2","4.8.1","4.8.0rc0","4.8.0","4.7.12","4.7.11","4.7.10","4.7.9","4.7.8","4.7.7","4.7.6","4.7.5","4.7.4","4.7.3","4.7.2","4.7.1","4.7.0","4.6.14","4.6.13","4.6.11","4.6.12","4.6.10","4.6.9","4.6.7","4.6.8","4.6.6","4.6.5","4.6.4","4.6.3","4.6.0","4.6.2","4.6.1","4.6.0rc1","4.6.0b1","4.6.0b0","4.6.0a2","4.6.0a1","4.5.0rc0","4.5.0","4.3.3","4.3.2","4.3.1","4.3.0","4.2.4","4.2.3","4.2.2","4.2.1","4.2.0","4.1.3","4.1.0","4.1.2","4.1.1","4.0.2","4.0.1","4.0.0","3.19.1","3.19.0","3.18.9","3.18.8","3.18.7","3.18.6","3.18.5","3.18.4","3.18.3","3.18.2","3.18.1","3.18.0","3.16.0","3.15.1","3.14.1","3.14.0","3.12.0","3.11.0","3.9.1","3.9.0","3.8.4","3.8.3","3.8.2","3.8.1","3.8.0","3.7.4","3.7.3","3.7.2","3.7.1","3.7.0","3.6.2","3.6.0","3.5.4","3.5.2","3.5.1","3.5.0","3.4.3","3.4.2","3.4.1","3.4.0","3.3.2","3.3.1","3.3.0","3.2.1","3.2.0","3.2.0a1","3.1.0","3.0.6","3.0.5","3.0.3","3.0.2","3.0.1","2.3.1","2.3.0","2.2.8","2.2.2","2.2.1","2.2.0","2.1.0","2.0.4","2.0.3","2.0.2","2.0.1","2.0.0","1.9.1","1.9.0","1.8.2","1.8.1","1.8.0","1.7.2","1.7.1","1.7.0","1.6.0","1.6.0rc2","1.6.0rc1","1.5.2","1.5.0","1.4.6","1.4.5","1.4.4","1.4.3","1.4.2","1.4.1","1.4.0","1.3.5","1.3.4","1.3.3","1.3.2","1.3.1","1.3.0","1.2.1","1.2.0","1.1.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-53940.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}]}