CVE-2026-46699

7.6 Élevée

Publiée le 18/06/2026 à 23:16 · Modifiée le 23/06/2026 à 18:06 · Analyse NVD reportée · Source : security-advisories@github.com

Description

conda-smithy is a tool for combining a conda recipe with configurations to build using freely hosted CI services into a single repository. Prior to version 3.61.0, a vulnerability in the conda-forge automated webservices allowed unintended write access to feedstock repositories through GitHub username takeover. The root cause is the use of mutable GitHub usernames as identifiers for repository invitation routing, rather than stable, immutable GitHub user IDs. Version 3.61.0 fixes the issue.

Traduire en français

Produits concernés

conda-forge conda-smithy

Scores CVSS

Version	Score	Source	Vecteur
3.1	7.6 Élevée	security-advisories@github.com	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:L`

Faiblesses (CWE)

CWE-284

Références

https://github.com/conda-forge/conda-smithy/commit/3b0bcd92ebd6f41edd341401d84583a20911c587
https://github.com/conda-forge/conda-smithy/security/advisories/GHSA-g95q-3cmj-fvh8

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories