https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2025-32800.htmlhttps://patchthecve.com/cve/CVE-2025-32800.htmlWed, 17 Jun 2026 09:12:35 +0000CRITICAL 9.8: Conda-build contains commands and tools to build conda packages. Prior to version 25.3.0, the pyproject.toml lists conda-index as a Python dependency. This package is not published in PyPI. An attacker could claim this namespace and upload arbitrary (malicious) code to the package, and then exploit https://patchthecve.com/cve/CVE-2025-32799.htmlhttps://patchthecve.com/cve/CVE-2025-32799.htmlWed, 17 Jun 2026 09:12:35 +0000CRITICAL 9.8: Conda-build contains commands and tools to build conda packages. Prior to version 25.4.0, the conda-build processing logic is vulnerable to path traversal (Tarslip) attacks due to improper sanitization of tar entry paths. Attackers can craft tar archives containing entries with directory traversal shttps://patchthecve.com/cve/CVE-2025-32798.htmlhttps://patchthecve.com/cve/CVE-2025-32798.htmlWed, 17 Jun 2026 09:12:35 +0000CRITICAL 9.8: Conda-build contains commands and tools to build conda packages. Prior to version 25.4.0, the conda-build recipe processing logic has been found to be vulnerable to arbitrary code execution due to unsafe evaluation of recipe selectors. Currently, conda-build uses the eval function to process embeddehttps://patchthecve.com/cve/CVE-2025-32797.htmlhttps://patchthecve.com/cve/CVE-2025-32797.htmlWed, 17 Jun 2026 09:12:35 +0000HIGH 7.0: Conda-build contains commands and tools to build conda packages. Prior to version 25.3.1, the write_build_scripts function in conda-build creates the temporary build script conda_build.sh with overly permissive file permissions (0o766), allowing write access to all users. Attackers with filesystem a