CVE-2026-53942
Received Received - Intake

BaseFortify

Publication date: 2026-10-23

Last updated on: 2026-10-23

Assigner: GitHub, Inc.

Description
Conda Organization Infrastructure is a centralized location for infrastructure codes. Prior to commit 9c0f238, a GitHub Actions Pwn Request vulnerability appears to remain present in conda/conda. The affected workflow is .github/workflows/update.yml. It is triggered by issue_comment events containing @conda-bot render or @conda-bot recreate. For the render path, the workflow obtains the pull request head repository and branch from the PR API, checks out that PR-controlled repository/ref using secrets.SYNC_TOKEN, and then runs conda/actions/template-files@7f6830b1428a9bd47f0b068892c77eae95207037. The external template-files action reads its default configuration and templates from the checked-out working directory. In the confirmed finding, that action uses an unsandboxed Jinja2 environment to render attacker-controlled template content. This creates a Pwn Request chain in which an untrusted PR/comment path can reach template rendering in a privileged token context. This issue has been patched via commit 9c0f238.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-23
Last Modified
2026-10-23
Generated
2026-10-23
AI Q&A
2026-10-23
EPSS Evaluated
N/A
NVD
CVE-2026-53942
EUVD
EUVD-2026-109068

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
conda infrastructure < 9c0f23857282ff5cf7a6b3ad6bf0dd6f9974be55

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves a GitHub Actions workflow in conda/conda that can be exploited via malicious issue comments. The workflow uses secrets.SYNC_TOKEN to check out a pull request's repository and branch, then runs an external action that renders attacker-controlled templates using an unsandboxed Jinja2 environment. This allows an attacker to execute arbitrary code in a privileged context.

Impact Analysis

If exploited, this vulnerability could allow an attacker to gain unauthorized access to sensitive systems, modify or steal data, or disrupt services. The impact depends on the permissions of the SYNC_TOKEN secret, but it could lead to full compromise of the conda infrastructure.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's data protection requirements or HIPAA's security rules. It may result in non-compliance due to potential data breaches or loss of integrity.

Mitigation Strategies

Apply the patch from commit 9c0f238 to the affected workflow .github/workflows/update.yml. Remove or restrict the use of secrets.SYNC_TOKEN in the workflow to limit exposure. Review and sandbox any external actions like conda/actions/template-files to prevent template injection.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-53942. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart