{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-49823", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2025-06-11T14:33:57.798Z", "datePublished": "2025-06-17T02:21:17.496Z", "dateUpdated": "2025-06-17T15:52:25.295Z"}, "containers": {"cna": {"title": "Conda Constructor Command Injection via Unsanitized User Input (Low)", "problemTypes": [{"descriptions": [{"cweId": "CWE-77", "lang": "en", "description": "CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "PHYSICAL", "availabilityImpact": "NONE", "baseScore": 0, "baseSeverity": "NONE", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:P/AC:H/PR:H/UI:R/S:C/C:N/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/conda/constructor/security/advisories/GHSA-44q9-rg2q-5g99", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/conda/constructor/security/advisories/GHSA-44q9-rg2q-5g99"}, {"name": "https://github.com/conda/constructor/commit/ce4c2d58cfcde2f62d038fb8aba013176c77a0b1", "tags": ["x_refsource_MISC"], "url": "https://github.com/conda/constructor/commit/ce4c2d58cfcde2f62d038fb8aba013176c77a0b1"}], "affected": [{"vendor": "conda", "product": "constructor", "versions": [{"version": "< 3.11.3", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-06-17T02:21:17.496Z"}, "descriptions": [{"lang": "en", "value": "(conda) Constructor is a tool which allows constructing an installer for a collection of conda packages. Prior to version 3.11.3, shell installer scripts process the installation prefix (user_prefix) using an eval statement, which executes unsanitized user input as shell code. Although the script runs with user privileges (not root), an attacker could exploit this by injecting arbitrary commands through a malicious path during installation. Exploitation requires explicit user action. This issue has been patched in version 3.11.3."}], "source": {"advisory": "GHSA-44q9-rg2q-5g99", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-06-17T15:51:15.900223Z", "id": "CVE-2025-49823", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-06-17T15:52:25.295Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-49823", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-06-17T15:51:15.900223Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-06-17T15:52:16.702Z"}}], "cna": {"title": "Conda Constructor Command Injection via Unsanitized User Input (Low)", "source": {"advisory": "GHSA-44q9-rg2q-5g99", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 0, "attackVector": "PHYSICAL", "baseSeverity": "NONE", "vectorString": "CVSS:3.1/AV:P/AC:H/PR:H/UI:R/S:C/C:N/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "conda", "product": "constructor", "versions": [{"status": "affected", "version": "< 3.11.3"}]}], "references": [{"url": "https://github.com/conda/constructor/security/advisories/GHSA-44q9-rg2q-5g99", "name": "https://github.com/conda/constructor/security/advisories/GHSA-44q9-rg2q-5g99", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/conda/constructor/commit/ce4c2d58cfcde2f62d038fb8aba013176c77a0b1", "name": "https://github.com/conda/constructor/commit/ce4c2d58cfcde2f62d038fb8aba013176c77a0b1", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "(conda) Constructor is a tool which allows constructing an installer for a collection of conda packages. Prior to version 3.11.3, shell installer scripts process the installation prefix (user_prefix) using an eval statement, which executes unsanitized user input as shell code. Although the script runs with user privileges (not root), an attacker could exploit this by injecting arbitrary commands through a malicious path during installation. Exploitation requires explicit user action. This issue has been patched in version 3.11.3."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-77", "description": "CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-06-17T02:21:17.496Z"}}}, "cveMetadata": {"cveId": "CVE-2025-49823", "state": "PUBLISHED", "dateUpdated": "2025-06-17T15:52:25.295Z", "dateReserved": "2025-06-11T14:33:57.798Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2025-06-17T02:21:17.496Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "(conda) Constructor is a tool which allows constructing an installer for a collection of conda packages. Prior to version 3.11.3, shell installer scripts process the installation prefix (user_prefix) using an eval statement, which executes unsanitized user input as shell code. Although the script runs with user privileges (not root), an attacker could exploit this by injecting arbitrary commands through a malicious path during installation. Exploitation requires explicit user action. This issue has been patched in version 3.11.3."}, {"lang": "es", "value": "(conda) Constructor es una herramienta que permite construir un instalador para una colecci\u00f3n de paquetes conda. Antes de la versi\u00f3n 3.11.3, los scripts de instalaci\u00f3n de shell procesaban el prefijo de instalaci\u00f3n (user_prefix) mediante una sentencia eval, que ejecutaba la entrada de usuario no autorizada como c\u00f3digo de shell. Aunque el script se ejecuta con privilegios de usuario (no root), un atacante podr\u00eda aprovechar esto inyectando comandos arbitrarios a trav\u00e9s de una ruta maliciosa durante la instalaci\u00f3n. La explotaci\u00f3n requiere una acci\u00f3n expl\u00edcita del usuario. Este problema se ha corregido en la versi\u00f3n 3.11.3."}], "id": "CVE-2025-49823", "lastModified": "2025-06-17T20:50:23.507", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "PHYSICAL", "availabilityImpact": "NONE", "baseScore": 0.0, "baseSeverity": "NONE", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:P/AC:H/PR:H/UI:R/S:C/C:N/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 0.2, "impactScore": 0.0, "source": "security-advisories@github.com", "type": "Secondary"}]}, "published": "2025-06-17T03:15:24.580", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/conda/constructor/commit/ce4c2d58cfcde2f62d038fb8aba013176c77a0b1"}, {"source": "security-advisories@github.com", "url": "https://github.com/conda/constructor/security/advisories/GHSA-44q9-rg2q-5g99"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-77"}], "source": "security-advisories@github.com", "type": "Primary"}]}

{}