## Summary `EntryPoint::FromStr` in `rattler_conda_types` performs only `.trim()` on the `command` field before the linker joins it onto the install prefix and writes an executable Python script. A malicious `noarch:python` package can ship an `info/link.json` with an entry-point name containing `..`, `/`, `\`, or an absolute path; the resulting file is written outside the prefix (or clobbers an existing in-prefix entry-point such as `bin/pip`) with mode `0o775` on Unix and a copied launcher `.exe` on Windows. This affects the default install path of `pixi install`, `rattler-build`, some methods in `py-rattler`, and any other consumer of the `rattler` install crate; no flag or post-link-script opt-in is involved. Resolved in https://github.com/conda/rattler/pull/2445, released in rattler 0.43.2. ## Affected - Repository: https://github.com/conda/rattler - Commit: `a0e61a33da8b9d6de712fab2a879fa9da977e6e3` (HEAD at audit time, 2026-05-13 release) - Downstream consumers reached through the same code path: `prefix-dev/pixi` @ `e640477` - pixi 0.69.0 and rattler-build 0.65.0 fix this issue ## Researcher Berkant Koc <[email protected]> PGP: 0C588DFD76204987284213EA0AC529C41F8AA5D6
## Summary `EntryPoint::FromStr` in `rattler_conda_types` performs only `.trim()` on the `command` field before the linker joins it onto the install prefix and writes an executable Python script. A malicious `noarch:python` package can ship an `info/link.json` with an entry-point name containing `..`, `/`, `\`, or an absolute path; the resulting file is written outside the prefix (or clobbers an existing in-prefix entry-point such as `bin/pip`) with mode `0o775` on Unix and a copied launcher `.exe` on Windows. This affects the default install path of `pixi install`, `rattler-build`, some methods in `py-rattler`, and any other consumer of the `rattler` install crate; no flag or post-link-script opt-in is involved. Resolved in https://github.com/conda/rattler/pull/2445, released in rattler 0.43.2. ## Affected - Repository: https://github.com/conda/rattler - Commit: `a0e61a33da8b9d6de712fab2a879fa9da977e6e3` (HEAD at audit time, 2026-05-13 release) - Downstream consumers reached through the same code path: `prefix-dev/pixi` @ `e640477` - pixi 0.69.0 and rattler-build 0.65.0 fix this issue ## Researcher Berkant Koc <[email protected]> PGP: 0C588DFD76204987284213EA0AC529C41F8AA5D6
Update py-rattler to 0.24.0; rattler to 0.43.2 if you use the affected versions. Test the change in a non-production environment first.
Local check
hol-guard supply-chain scanrattler has an entry-point path traversal in noarch:python install (arbitrary file write) affects py-rattler (pip), rattler (rust). Severity is medium. ## Summary `EntryPoint::FromStr` in `rattler_conda_types` performs only `.trim()` on the `command` field before the linker joins it onto the install prefix and writes an executable Python script. A malicious `noarch:python` package can ship an `info/link.json` with an entry-point name containing `..`, `/`, `\`, or an absolute path; the resulting file is written outside the prefix (or clobbers an existing in-prefix entry-point such as `bin/pip`) with mode `0o775` on Unix and a copied launcher `.exe` on Windows. This affects the default install path of `pixi install`, `rattler-build`, some methods in `py-rattler`, and any other consumer of the `rattler` install crate; no flag or post-link-script opt-in is involved. Resolved in https://github.com/conda/rattler/pull/2445, released in rattler 0.43.2. ## Affected - Repository: https://github.com/conda/rattler - Commit: `a0e61a33da8b9d6de712fab2a879fa9da977e6e3` (HEAD at audit time, 2026-05-13 release) - Downstream consumers reached through the same code path: `prefix-dev/pixi` @ `e640477` - pixi 0.69.0 and rattler-build 0.65.0 fix this issue ## Researcher Berkant Koc <[email protected]> PGP: 0C588DFD76204987284213EA0AC529C41F8AA5D6
AI coding agents often install or upgrade packages automatically in pip and rust. A medium vulnerability in a dependency can be pulled into a project through a normal install or update without a human reviewing the change, expanding the blast radius from a single package to every agent workspace that depends on it.
| Package | Affected range | Fixed version |
|---|---|---|
| py-rattlerpip | <=0.23.2 | 0.24.0 |
| rattlerrust | <0.43.2 | 0.43.2 |
Fixed versions are reported by the source feed; confirm compatibility before updating.
Reported by GitHub Security Advisories (ghsa).
HOL Guard can help your team review package activity against supported protection paths.
Explore HOL GuardUpdate py-rattler to 0.24.0; rattler to 0.43.2 if you use the affected versions. Test the change in a non-production environment first.
Local check
hol-guard supply-chain scanrattler has an entry-point path traversal in noarch:python install (arbitrary file write) affects py-rattler (pip), rattler (rust). Severity is medium. ## Summary `EntryPoint::FromStr` in `rattler_conda_types` performs only `.trim()` on the `command` field before the linker joins it onto the install prefix and writes an executable Python script. A malicious `noarch:python` package can ship an `info/link.json` with an entry-point name containing `..`, `/`, `\`, or an absolute path; the resulting file is written outside the prefix (or clobbers an existing in-prefix entry-point such as `bin/pip`) with mode `0o775` on Unix and a copied launcher `.exe` on Windows. This affects the default install path of `pixi install`, `rattler-build`, some methods in `py-rattler`, and any other consumer of the `rattler` install crate; no flag or post-link-script opt-in is involved. Resolved in https://github.com/conda/rattler/pull/2445, released in rattler 0.43.2. ## Affected - Repository: https://github.com/conda/rattler - Commit: `a0e61a33da8b9d6de712fab2a879fa9da977e6e3` (HEAD at audit time, 2026-05-13 release) - Downstream consumers reached through the same code path: `prefix-dev/pixi` @ `e640477` - pixi 0.69.0 and rattler-build 0.65.0 fix this issue ## Researcher Berkant Koc <[email protected]> PGP: 0C588DFD76204987284213EA0AC529C41F8AA5D6
AI coding agents often install or upgrade packages automatically in pip and rust. A medium vulnerability in a dependency can be pulled into a project through a normal install or update without a human reviewing the change, expanding the blast radius from a single package to every agent workspace that depends on it.
| Package | Affected range | Fixed version |
|---|---|---|
| py-rattlerpip | <=0.23.2 | 0.24.0 |
| rattlerrust | <0.43.2 | 0.43.2 |
Fixed versions are reported by the source feed; confirm compatibility before updating.
Reported by GitHub Security Advisories (ghsa).
HOL Guard can help your team review package activity against supported protection paths.
Explore HOL Guard