Critical severity · published Mar 4, 2025
CVE-2025-27510
RCE in the package conda-forge-metadata
9.3
CVSS
0.6%
EPSS
No
On KEV
Description
conda-forge-metadata provides programatic access to conda-forge's metadata. conda-forge-metadata uses an optional dependency - "conda-oci-mirror" which was neither present on the PyPi repository nor registered by any entity. If conda-oci-mirror is taken over by a threat actor, it can result in remote code execution.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 50% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CO
conda-forge-metadata · conda-forge
<= 0.4.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-27510
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-27510
github.com
https://github.com/conda-forge/conda-forge-metadata/blob/799aee36b21ee06289d73d57838b28201f5a57af/pyproject.toml#L28
github.com
https://github.com/conda-forge/conda-forge-metadata/security/advisories/GHSA-vwfh-m3q7-9jpw