CVE-2025-49842
conda-forge-webservices Privilege Escalation Risk via Default Docker Root User
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
conda-forge-webservices Privilege Escalation Risk via Default Docker Root User
conda-forge-webservices is the web app deployed to run conda-forge admin commands and linting. Prior to version 2025.3.24, the conda_forge_webservice Docker container executes commands without specifying a user. By default, Docker containers run as the root user, which increases the risk of privilege escalation and host compromise if a vulnerability is exploited. This issue has been patched in version 2025.3.24.
Reserved 2025-06-11 | Published 2025-06-17 | Updated 2025-06-17 | Assigner GitHub_MCWE-276: Incorrect Default Permissions
github.com/...rvices/security/advisories/GHSA-3cj6-wc22-wvpv
github.com/...ommit/c28b67f833f32299cc47eef8ad226ca991db67ae
Support options
