CVE-2026-47425: Rattler Python Install (arbitrary File Write) Vulnerability

MODERATE
Advisory Identifier: GHSA-q53q-5r4j-5729
Share
CWE-73 CWE-22
Published
Advisory Summary

CVE-2026-47425 is a MODERATE python install (arbitrary file write) vulnerability (CWE-73: External Control of File Name or Path) affecting Rattler libraries in the crates.io ecosystem. The issue involves python install (arbitrary file write). Remediation is available by upgrading affected packages to version 0.43.2, 0.24.0.

CVE-2026-47425 at a Glance

CVE Identifier CVE-2026-47425
GHSA Identifier GHSA-q53q-5r4j-5729
Severity MODERATE
CVSS v3.1 Base Score N/A
CWE Classification CWE-73: External Control of File Name or Path
Affected Product Rattler
Package Ecosystem crates.io
Published Date
Last Updated

How to Fix CVE-2026-47425

To remediate this vulnerability, upgrade all affected Rattler dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

rattler fixed: 0.43.2 
Upgrade rattler to 0.43.2
py-rattler fixed: 0.24.0 
pip install py-rattler>=0.24.0
Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

inspect dependencies for rattler

How to Check if You Are Affected

To determine whether your application is affected by CVE-2026-47425, inspect your project dependencies for Rattler:

inspect dependencies for rattler

Analyze the terminal output to locate any version of Rattler in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 0.43.2), your application is affected.

Note: Verify declared build manifests and deployed runtime container environments.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-73: External Control of File Name or Path, where the product allows user input to control or influence paths or file names that are used in filesystem operations. In Rattler, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

## Summary `EntryPoint::FromStr` in `rattler_conda_types` performs only `.trim()` on the `command` field before the linker joins it onto the install prefix and writes an executable Python script. A malicious `noarch:python` package can ship an `info/link.json` with an entry-point name containing `..`, `/`, `\`, or an absolute path; the resulting file is written outside the prefix (or clobbers an existing in-prefix entry-point such as `bin/pip`) with mode `0o775` on Unix and a copied launcher `.exe` on Windows. This affects the default install path of `pixi install`, `rattler-build`, some methods in `py-rattler`, and any other consumer of the `rattler` install crate; no flag or post-link-script opt-in is involved. Resolved in https://github.com/conda/rattler/pull/2445, released in rattler 0.43.2. ## Affected - Repository: https://github.com/conda/rattler - Commit: `a0e61a33da8b9d6de712fab2a879fa9da977e6e3` (HEAD at audit time, 2026-05-13 release) - Downstream consumers reached through the same code path: `prefix-dev/pixi` @ `e640477` - pixi 0.69.0 and rattler-build 0.65.0 fix this issue ## Researcher Berkant Koc <me@berkoc.com> PGP: 0C588DFD76204987284213EA0AC529C41F8AA5D6

CVE-2026-47425 Affected Rattler Versions

2 component(s)
Fixed Versions:
0.43.20.24.0
Product / Package Ecosystem Affected Versions Fixed Version
rattler
 crates.io
< 0.43.2
0.43.2
py-rattler
pypi/py-rattler
PyPI
< 0.24.0
0.24.0

References

GitHub Advisory / Wiki ADVISORY
https://github.com/conda/rattler/security/advisories/GHSA-q53q-5r4j-5729
Rattler Source Repository REPOSITORY
https://github.com/conda/rattler/pull/2445
Rattler Source Repository REPOSITORY
https://github.com/conda/rattler

Frequently Asked Questions

What is CVE-2026-47425?
CVE-2026-47425 is a security vulnerability in Rattler involving python install (arbitrary file write) under CWE-73: External Control of File Name or Path.
Which Rattler versions are affected?
Affected versions include releases prior to 0.43.2, 0.24.0 across affected packages: rattler, py-rattler.
What version fixes CVE-2026-47425?
Upgrading to 0.43.2, 0.24.0 (or the latest patched release for your respective branch) resolves the vulnerability.
Is rattler affected?
Yes, rattler is affected in releases prior to 0.43.2. Upgrade your dependency to 0.43.2 or later.
Is py-rattler affected?
Yes, py-rattler is affected in releases prior to 0.24.0. Upgrade your dependency to 0.24.0 or later.
What CWE is associated with CVE-2026-47425?
CVE-2026-47425 is classified under CWE-73: External Control of File Name or Path (The product allows user input to control or influence paths or file names that are used in filesystem operations.).
How can I check crates.io dependencies for CVE-2026-47425?
Run the dependency tree command: 'inspect dependencies for rattler'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-q53q-5r4j-5729",
  "modified" : "2026-06-09T11:52:08Z",
  "published" : "2026-06-01T14:15:31Z",
  "aliases" : [ "CVE-2026-47425" ],
  "summary" : "rattler has an entry-point path traversal in noarch:python install (arbitrary file write)",
  "details" : "## Summary\n\n`EntryPoint::FromStr` in `rattler_conda_types` performs only `.trim()` on the `command` field before the linker joins it onto the install prefix and writes an executable Python script. A malicious `noarch:python` package can ship an `info/link.json` with an entry-point name containing `..`, `/`, `\\`, or an absolute path; the resulting file is written outside the prefix (or clobbers an existing in-prefix entry-point such as `bin/pip`) with mode `0o775` on Unix and a copied launcher `.exe` on Windows. This affects the default install path of `pixi install`, `rattler-build`, some methods in `py-rattler`, and any other consumer of the `rattler` install crate; no flag or post-link-script opt-in is involved.\n\nResolved in https://github.com/conda/rattler/pull/2445, released in rattler 0.43.2.\n\n## Affected\n\n- Repository: https://github.com/conda/rattler\n- Commit: `a0e61a33da8b9d6de712fab2a879fa9da977e6e3` (HEAD at audit time, 2026-05-13 release)\n- Downstream consumers reached through the same code path: `prefix-dev/pixi` @ `e640477`\n- pixi 0.69.0 and rattler-build 0.65.0 fix this issue\n\n## Researcher\n\nBerkant Koc <me@berkoc.com>\nPGP: 0C588DFD76204987284213EA0AC529C41F8AA5D6",
  "severity" : [ {
    "type" : "CVSS_V4",
    "score" : "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "crates.io",
      "name" : "rattler"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "0.43.2"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "PyPI",
      "name" : "py-rattler"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "0.24.0"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 0.23.2"
    }
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/conda/rattler/security/advisories/GHSA-q53q-5r4j-5729"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/conda/rattler/pull/2445"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/conda/rattler"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-22", "CWE-73" ],
    "severity" : "MODERATE",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-06-01T14:15:31Z",
    "nvd_published_at" : null
  }
}