CVE-2026-47425: Rattler Path Traversal Vulnerability

CVE-2026-47425 Overview

CVE-2026-47425 is a path traversal vulnerability [CWE-22] in Rattler, a Rust library that provides core functionality for the conda ecosystem. The flaw affects versions prior to 0.43.2 and resides in EntryPoint::FromStr within the rattler_conda_types crate. The linker only applies .trim() to the entry-point command field before joining it onto the install prefix and writing an executable Python script. A malicious noarch:python package can supply an info/link.json with an entry-point name containing .., /, \, or an absolute path, causing files to be written outside the prefix or overwriting existing entry points such as bin/pip.

Critical Impact
A malicious conda package can write arbitrary executable files outside the install prefix, or clobber trusted in-prefix binaries, during a routine pixi install or mamba install operation.

Affected Products

Rattler rattler_conda_types crate prior to version 0.43.2
Consumers of the rattler install crate: pixi install, mamba install via py-rattler, and rattler-build
Any downstream tooling built on the affected Rattler install path

Discovery Timeline

2026-07-21 - CVE CVE-2026-47425 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-47425

Vulnerability Analysis

Rattler is responsible for materializing conda packages into a local environment. When a noarch:python package is installed, Rattler reads entry-point definitions from info/link.json and generates executable Python launcher scripts under the environment prefix. The linker treats the command field as a trusted relative filename and appends it directly to the prefix path. No canonicalization, character filtering, or containment check is performed against the resolved path.

An attacker who publishes or substitutes a conda package can therefore control the destination path of a launcher file. On Unix, the file is written with mode 0o775, which makes it directly executable. On Windows, a launcher .exe is copied to the attacker-controlled location. Because this occurs on the default install path, no post-link script, elevated flag, or user opt-in is required to trigger the write.

Root Cause

The root cause is missing input validation in EntryPoint::FromStr. The parser sanitizes only surrounding whitespace via .trim() and does not reject path separators, parent-directory tokens (..), or absolute paths in the entry-point name. Downstream code trusts that value and joins it against the install prefix.

Attack Vector

The attack vector is local and requires the victim to install a crafted noarch:python package. The malicious package ships an info/link.json containing an entry-point name such as ../../../../etc/cron.d/payload or bin/pip. On installation, the launcher script is written to that path with executable permissions, enabling either arbitrary file placement outside the prefix or replacement of trusted binaries inside the prefix.

rust

     about::AboutJson,
     archive_identifier::{ArchiveIdentifier, CondaArchiveIdentifier, DistArchiveIdentifier},
     archive_type::{CondaArchiveType, DistArchiveType, WheelArchiveType},
-    entry_point::EntryPoint,
+    entry_point::{EntryPoint, EntryPointDottedField, ParseEntryPointError},
     files::Files,
     has_prefix::HasPrefix,
     has_prefix::HasPrefixEntry,

Source: conda/rattler commit 4f06eca — the patch introduces ParseEntryPointError and rejects path traversal sequences during entry-point parsing.

Detection Methods for CVE-2026-47425

Indicators of Compromise

Files with mode 0o775 written outside the conda environment prefix during or immediately after a pixi install, mamba install, or rattler-build operation.
In-prefix launchers such as bin/pip, bin/conda, or Scripts\pip.exe whose contents or hashes differ from the vendor-provided originals.
info/link.json files inside cached conda packages containing entry-point command values with .., /, \, or absolute paths.

Detection Strategies

Audit installed conda packages by parsing info/link.json and flagging any entry-point name that is not a bare identifier.
Compare hashes of critical launcher scripts (pip, python, conda) against known-good baselines after package installations.
Enable filesystem auditing on directories outside the environment prefix that are common targets, such as /etc, ~/.ssh, and user autostart paths.

Monitoring Recommendations

Log process execution of pixi, mamba, rattler-build, and any tooling embedding py-rattler, and correlate with subsequent file writes outside the target prefix.
Alert on newly created executable files (0o775 on Unix, .exe on Windows) written by these package managers to paths that do not begin with the resolved environment prefix.
Track Rattler and py-rattler versions across developer and build systems to identify hosts still running versions prior to 0.43.2.

How to Mitigate CVE-2026-47425

Immediate Actions Required

Upgrade Rattler and py-rattler to version 0.43.2 or later on all developer workstations, CI runners, and container images.
Rebuild or refresh any base images and lockfile-driven environments that were produced with vulnerable Rattler versions.
Restrict conda package sources to trusted channels and enforce channel allow-lists in pixi, mamba, and rattler-build configurations.

Patch Information

The fix is included in Rattler 0.43.2. The patch adds a dedicated ParseEntryPointError and rejects entry-point names containing path separators or parent-directory components. Full technical details are available in the GitHub Security Advisory GHSA-q53q-5r4j-5729 and the upstream commit 4f06eca.

Workarounds

Install conda packages only from vetted internal mirrors until all tooling is upgraded to 0.43.2.
Inspect info/link.json in third-party noarch:python packages and reject any entry-point command that contains .., /, \, or an absolute path prefix.
Run package installations under least-privilege user accounts and inside ephemeral sandboxes to bound the impact of unexpected file writes.

bash

# Upgrade py-rattler to the fixed release
pip install --upgrade "py-rattler>=0.43.2"

# Verify installed version
python -c "import rattler; print(rattler.__version__)"

# For Rust consumers, update Cargo.toml
# rattler_conda_types = ">=0.43.2"
cargo update -p rattler_conda_types