The vulnerability arises from an unsandboxed Jinja2 environment used in the conda/actions/template-files action, which is executed in a privileged context during a Conda GitHub Actions workflow. An attacker can inject Jinja2 code through a pull‑request–controlled template file, causing arbitrary code execution with the privileges of the workflow token. This enables the attacker to modify repository configurations, deploy malicious artifacts, or otherwise compromise the infrastructure managing Conda packages.

Conda Organization Infrastructure, specifically the .github/workflows/update.yml workflow triggered by issue_comment events such as @conda-bot render or @conda-bot recreate. The affected code resides in the conda/infrastructure repository prior to commit 9c0f23857282ff5cf7a6b3ad6bf0dd6f9974be55 and relies on the conda/actions/template-files action.

The CVSS score of 9.9 indicates a critical severity. Because the exploit path leverages a privileged SYNC_TOKEN and the GitHub Actions environment, the potential impact is system‑wide and the likelihood is high wherever the workflow is active. The EPSS score is not available, but the lack of a KEV listing does not diminish the risk; the vulnerability remains exploitable until the patch is applied. The attack vector is likely a malicious pull request or comment that triggers the workflow and supplies the exploited template.