6.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-47425

CVE-2026-47425: rattler has an entry-point path traversal in noarch:python install (arbitrary file write)

Summary

EntryPoint::FromStr in rattler_conda_types performs only .trim() on the command field before the linker joins it onto the install prefix and writes an executable Python script. A malicious noarch:python package can ship an info/link.json with an entry-point name containing .., /, \, or an absolute path; the resulting file is written outside the prefix (or clobbers an existing in-prefix entry-point such as bin/pip) with mode 0o775 on Unix and a copied launcher .exe on Windows. This affects the default install path of pixi install, rattler-build, some methods in py-rattler, and any other consumer of the rattler install crate; no flag or post-link-script opt-in is involved.

Resolved in https://github.com/conda/rattler/pull/2445, released in rattler 0.43.2.

Affected

Repository: https://github.com/conda/rattler
Commit: a0e61a33da8b9d6de712fab2a879fa9da977e6e3 (HEAD at audit time, 2026-05-13 release)
Downstream consumers reached through the same code path: prefix-dev/pixi @ e640477
pixi 0.69.0 and rattler-build 0.65.0 fix this issue

Researcher

Berkant Koc me@berkoc.com PGP: 0C588DFD76204987284213EA0AC529C41F8AA5D6

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-47425

CVE-2026-47425:

6.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
rattler	rust	< 0.43.2	0.43.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a path traversal issue that allows an attacker to write arbitrary files during package installation. The root cause lies in the rattler_conda_types::package::entry_point::EntryPoint::from_str function, which parses entry point specifications from package metadata. Prior to the fix, this function did not properly sanitize the 'command' part of the entry point string, allowing path traversal characters like .., /, and \. This malicious 'command' string is then stored in an EntryPoint object.

This tainted EntryPoint object is later used by rattler::install::entry_point::create_windows_python_entry_point and rattler::install::entry_point::create_unix_python_entry_point to generate and write entry point scripts to the filesystem. These functions would construct a file path by joining the malicious 'command' to a base directory, resulting in a path that points outside the intended installation prefix. This allows a specially crafted package to write or overwrite files anywhere the user running the installation has write permissions.

The patch addresses this by introducing two layers of validation. First, EntryPoint::from_str is updated to strictly validate the 'command' as a simple filename, rejecting any path separators or traversal sequences. Second, the functions that write to the filesystem in rattler::install::entry_point were updated to use a new ensure_entry_point_relative_path function, which performs a defense-in-depth check to ensure the final path is within the installation prefix before any file is written.

Vulnerable functions

rattler_conda_types::package::entry_point::EntryPoint::from_str

crates/rattler_conda_types/src/package/entry_point.rs

This function parses an entry point string from a package's metadata. The vulnerability lies in its failure to validate the `command` part of the string before the patch. It would only trim whitespace, allowing path traversal characters (`..`, `/`, `\`) to be included in the `command` field of the returned `EntryPoint` struct. This malicious command is then used by other functions to construct file paths for entry point scripts, leading to arbitrary file writes.

rattler::install::entry_point::create_windows_python_entry_point

crates/rattler/src/install/entry_point.rs

This function is responsible for creating Python entry point scripts on Windows. Before the patch, it used the unvalidated `entry_point.command` field to construct file paths. A malicious `command` containing path traversal sequences could cause this function to write files outside of the intended installation directory, leading to an arbitrary file write vulnerability.

rattler::install::entry_point::create_unix_python_entry_point

crates/rattler/src/install/entry_point.rs

This function is responsible for creating Python entry point scripts on Unix-like systems. Before the patch, it used the unvalidated `entry_point.command` field to construct a file path. A malicious `command` containing path traversal sequences could cause this function to write a file outside of the intended installation directory, leading to an arbitrary file write vulnerability.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.