Rattler is a library that provides common functionality used within the conda ecosystem. Prior to version 0.43.2, EntryPoint::FromStr in rattler_conda_types only trims the command field before the linker joins it onto the install prefix and writes an executable Python script. A malicious noarch:python package can ship an info/link.json with an entry‑point name containing .., /, \, or an absolute path; the resulting file is then written outside the prefix (or clobbers an existing in‑prefix entry‑point such as bin/pip) with mode 0o775 on Unix and a copied launcher .exe on Windows. This allows an attacker to place arbitrary files or overwrite executables in a user’s environment. The vulnerability maps to CWE‑22 (Path Traversal) and CWE‑73 (OS Command Injection).

The vulnerability affects Rattler versions older than 0.43.2, including the py‑rattler, rattler, and rattler‑build libraries, as well as any tooling that uses the rattler install crate such as pixi and mamba’s conda‑supports. These components operate within the conda ecosystem and execute during package installation, meaning the flaw is present whenever a malicious noarch:python package is supplied to the installer.

The CVSS score of 6.9 indicates moderate severity, while the EPSS score of less than 1% suggests a low probability of exploitation at present. The vulnerability is not listed in CISA’s KEV catalog. An attacker can gain exploitation capability by creating a malicious conda package and delivering it through a trusted or open channel. No special privileges are required beyond normal package installation rights, and the primary attack vector is a supply‑chain compromise that results in arbitrary file write or overwrite of executables in the target environment.