Conda Organization Infrastructure: Pwn Request in update workflow leads to template rendering with SYNC_TOKEN
Summary
The GitHub Actions workflow .github/workflows/update.yml in conda/conda, part of the conda organization's infrastructure, can be triggered by PR comments such as "@conda-bot render". It checks out the pull request's head repository and ref, which are controlled by the PR author, using the privileged secrets.SYNC_TOKEN. The pinned template-files action then renders attacker-controlled templates with an unsandboxed Jinja2 environment. An attacker who can open a pull request and post a comment could therefore run code in a privileged token context (CVSS 9.9, critical). This is a CI/CD issue in conda's own repositories, not in the conda package manager installed on user systems.
Affected
- conda/infrastructure: all versions before commit 9c0f23857282ff5cf7a6b3ad6bf0dd6f9974be55
- Workflow .github/workflows/update.yml in conda/conda, which uses conda/actions/template-files@7f6830b1428a9bd47f0b068892c77eae95207037
- No release version numbers published.
Fixed in
- Fixed in commit 9c0f23857282ff5cf7a6b3ad6bf0dd6f9974be55 (conda/infrastructure).
Workaround
- Unknown.
Exploitation
- No evidence of exploitation in the wild known to the sources.
- Not listed in CISA KEV. CISA SSVC: exploitation none, automatable no, technical impact total.
- No public proof of concept found.
Our recommendation
- No action needed for SMEs that only use conda packages.
- Audit any self-hosted or forked GitHub Actions workflows that run on issue_comment, check out pull request code and use secrets.
- Restrict such workflows to trusted actors and avoid running untrusted pull request code with privileged tokens.
- Monitor NVD and the GitHub advisory GHSA-pf87-fcg3-wjfh for updates, as NVD analysis is still pending.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Fix commit 9c0f238 (conda/infrastructure) github.com
- GitHub Security Advisory GHSA-pf87-fcg3-wjfh github.com
- CVE record via Vulners (CVELIST) vulners.com
- Strix CVE overview www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 14:56.
Original description (NVD)
Conda Organization Infrastructure is a centralized location for infrastructure codes. Prior to commit 9c0f238, a GitHub Actions Pwn Request vulnerability appears to remain present in conda/conda. The affected workflow is .github/workflows/update.yml. It is triggered by issue_comment events containing @conda-bot render or @conda-bot recreate. For the render path, the workflow obtains the pull request head repository and branch from the PR API, checks out that PR-controlled repository/ref using secrets.SYNC_TOKEN, and then runs conda/actions/template-files@7f6830b1428a9bd47f0b068892c77eae95207037. The external template-files action reads its default configuration and templates from the checked-out working directory. In the confirmed finding, that action uses an unsandboxed Jinja2 environment to render attacker-controlled template content. This creates a Pwn Request chain in which an untrusted PR/comment path can reach template rendering in a privileged token context. This issue has been patched via commit 9c0f238.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.