Race condition in conda-forge-webservices allows unauthorized artifact modification
A race condition vulnerability (CVE-2025-32784) in conda-forge-webservices allows attackers to exploit a gap between validation and artifact copying to introduce unauthorized modifications to software packages. The vulnerability affects the shared build infrastructure that validates artifacts before publication to the production conda-forge channel.
What happened
A race condition vulnerability (CVE-2025-32784, GHSA-28cx-74fp-g2g2) was identified in conda-forge-webservices, a Time-of-Check to Time-of-Use (TOCTOU) issue in the artifact validation process.
The OutputsCopyHandler service validates artifacts in the cf-staging Anaconda channel before promoting them to production using SHA-256 hash comparison, but the vulnerability allows exploitation between the validation check and the actual copy operation.
Reported impact
An attacker could introduce unauthorized modifications to build artifacts in the cf-staging channel, potentially resulting in the unauthorized publication of malicious artifacts to the production conda-forge channel.
Index analysis
The vulnerability affects conda-forge-webservices versions 2025.4.10 and earlier, with patched versions available after 2025.4.10.
The service is deployed on Heroku and processes HTTP POST requests to the /feedstock-outputs/copy endpoint from CI/CD build agents, verifying requests with a FEEDSTOCK_TOKEN for authentication.
Governance controls
A patch was deployed that added a _comment_on_core_notes_if_bad_copy function to validate output hashes after the copy operation and flag discrepancies by creating issues in the conda-forge/core-notes repository.
Classification
Sources and evidence
Sources not yet published
This record was researched and written by the Index from original reporting. Its sources are still being verified by an editor, and they are listed here once that check is complete. Until then the record carries no reviewer.