CVE-2026-53940: Conda Path Traversal Vulnerability

CVE-2026-53940 Overview

CVE-2026-53940 is a path traversal vulnerability [CWE-22] in Conda, the system-level binary package and environment manager. Versions prior to 26.5.2 accept unvalidated entry-point commands from noarch:python package metadata. A malicious package can use path separators, traversal segments, or absolute paths in info/link.json to write executable wrappers outside the installation prefix or overwrite existing in-prefix entry points. Overwritten entry points execute attacker-controlled Python code when invoked later with the installing user's privileges. The issue is fixed in Conda 26.5.2.

Critical Impact
Malicious Conda packages can write arbitrary executable wrappers outside the environment prefix or hijack existing entry points, achieving code execution as the installing user.

Affected Products

Conda versions prior to 26.5.2
Environments installing noarch:python packages from untrusted channels
Any platform running Conda (Linux, macOS, Windows)

Discovery Timeline

2026-09-21 - CVE-2026-53940 published to NVD
2026-09-24 - Last updated in NVD database

Technical Details for CVE-2026-53940

Vulnerability Analysis

The flaw resides in Conda's handling of Python entry points declared by noarch:python packages. The function parse_entry_point_def in conda/common/path/python.py accepts an entry-point command string from a package's info/link.json metadata without validating its structural safety.

CreatePythonEntryPointAction in conda/core/path_actions.py then interpolates that string into target_short_path. When PrefixPathAction.target_full_path joins it to the installation prefix, no check confirms the resolved path remains under the intended bin or Scripts directory. Finally, create_python_entry_point in conda/gateways/disk/create.py writes an executable wrapper to that path.

Root Cause

The root cause is missing path canonicalization and containment validation. Package metadata is treated as trusted input. Neither traversal segments (../), embedded path separators, nor absolute paths are rejected before the wrapper file is written to disk.

Attack Vector

An attacker publishes or supplies a crafted noarch:python package to a channel a victim installs from. During a default install or environment transaction, Conda parses the malicious entry-point command and writes the wrapper to an attacker-chosen location. Out-of-prefix writes succeed when the target parent directory already exists. Alternatively, the attacker overwrites an existing in-prefix entry point so that a legitimate command later executes attacker Python code.

python

# Security patch excerpt - conda/common/path/python.py
from __future__ import annotations

import keyword
import re
from logging import getLogger
from os.path import join, split, splitext

python

# Security patch excerpt - conda/core/path_actions.py
from __future__ import annotations

import os
import re
import sys
from abc import ABC, abstractmethod
from itertools import chain
from logging import getLogger
from os.path import basename, dirname, getsize, isdir, isfile, join, normpath
from typing import TYPE_CHECKING
from uuid import uuid4

Source: GitHub Commit 3987c86. The patch introduces normpath and keyword validation to constrain entry-point names and enforce prefix containment.

Detection Methods for CVE-2026-53940

Indicators of Compromise

Files written outside the Conda environment bin or Scripts directory during package installation
info/link.json entries containing path separators (/, \), traversal segments (..), or absolute paths in the command field
Unexpected modifications to existing entry-point scripts within Conda environments
Executable wrappers with mismatched timestamps or unexpected Python payloads

Detection Strategies

Audit installed noarch:python packages by inspecting info/link.json metadata for malformed entry-point commands
Monitor file creation events during conda install and conda env create transactions for writes outside <prefix>/bin or <prefix>/Scripts
Compare package files against upstream checksums from trusted channels such as conda-forge and defaults

Monitoring Recommendations

Log all Conda package installations centrally and alert on installs from non-standard or user-added channels
Enable file integrity monitoring on directories adjacent to Conda prefixes where a traversal write could land
Track process execution of Conda-installed entry points to detect unexpected Python invocations

How to Mitigate CVE-2026-53940

Immediate Actions Required

Upgrade Conda to version 26.5.2 or later on all systems and CI runners
Inventory environments that installed packages from untrusted or user-contributed channels since the vulnerability window
Rebuild suspect environments from scratch after upgrading Conda
Restrict package sources to vetted channels using channel_priority: strict and an explicit channel allowlist

Patch Information

The fix is delivered in Conda 26.5.2 via pull request #16168 and commit 3987c86. Full details are published in GitHub Security Advisory GHSA-9m8m-c4j3-rj2c and the 26.5.2 release notes.

Workarounds

Avoid installing noarch:python packages from untrusted channels until the upgrade is applied
Run Conda operations under a least-privileged user account with no write access to sensitive system directories
Validate info/link.json entry-point commands manually before installing third-party packages

bash

# Upgrade Conda to the patched release
conda update -n base -c defaults conda
conda --version   # verify 26.5.2 or later

# Restrict to trusted channels
conda config --set channel_priority strict
conda config --remove-key channels
conda config --add channels defaults