CVE-2025-32800

CVE-2025-32800 is a critical supply chain vulnerability affecting Conda-build versions prior to 25.3.0. It arises because Conda-build's pyproject.toml incorrectly lists 'conda-index' as a Python dependency, a package not published on PyPI. An attacker could claim this namespace, upload malicious code, and exploit pip install commands to inject the malicious dependency. This vulnerability carries a CVSS score of 9.8 (CRITICAL), indicating a severe risk with a network-based attack vector, low attack complexity, and high impact on confidentiality, integrity, and availability. The FAUCET Risk Score is 95/100. While there is no evidence of active exploitation or public exploit code (Metasploit, Nuclei, ExploitDB), the vulnerability has garnered significant community discussion with 10 mentions, suggesting awareness and concern within the cybersecurity community. The issue has been fixed in Conda-build version 25.3.0, and a workaround using '--no-deps' for pip installs is available.