Executive brief
Rattler is a library used by package managers like Pixi and Mamba to install software within the conda ecosystem. A vulnerability exists where a malicious software package can trick the installer into writing files outside of the intended installation folder. This could allow an attacker to overwrite system files or create malicious executable scripts, potentially leading to unauthorized code execution on a user's machine when they install a compromised package.
Technical details
A path traversal vulnerability exists in the `EntryPoint::FromStr` function within the `rattler_conda_types` crate. The library fails to properly sanitize the `command` field in a package's `info/link.json` file, performing only a whitespace trim. An attacker can craft a malicious `noarch:python` package containing path traversal characters (e.g., `..`, `/`, `\`) or absolute paths in the entry-point name. When a consumer of the rattler library (such as pixi, mamba, or rattler-build) installs this package, the linker will write an executable script to an arbitrary location outside the installation prefix or overwrite existing binaries like `bin/pip`. This issue is resolved in Rattler version 0.43.2 and corresponding downstream updates.
Affected products
- conda rattler < 0.43.2
- conda py-rattler < 0.24.0
- conda rattler-build < 0.65.0
- prefix-dev pixi < 0.69.0
Timeline
- 2026-05-19: patched: Fix committed to repository and released in version 0.43.2
- 2026-07-21: disclosed: Advisory published by GitHub and NVD