{"id":"CVE-2026-53942","kind":"vulnerability","aliases":["CVE-2026-53942"],"related":[],"title":"Conda CI comment trigger lets pull request code reach privileged token","description":"Conda Organization Infrastructure is a centralized location for infrastructure codes. Prior to commit 9c0f238, a GitHub Actions Pwn Request vulnerability appears to remain present in conda/conda. The affected workflow is .github/workflows/update.yml. It is triggered by issue_comment events containing @conda-bot render or @conda-bot recreate. For the render path, the workflow obtains the pull request head repository and branch from the PR API, checks out that PR-controlled repository/ref using secrets.SYNC_TOKEN, and then runs conda/actions/template-files@7f6830b1428a9bd47f0b068892c77eae95207037. The external template-files action reads its default configuration and templates from the checked-out working directory. In the confirmed finding, that action uses an unsandboxed Jinja2 environment to render attacker-controlled template content. This creates a Pwn Request chain in which an untrusted PR/comment path can reach template rendering in a privileged token context. This issue has been patched via commit 9c0f238.","summary":"The update.yml workflow in conda/infrastructure was triggered by PR comments ('@conda-bot render'). It checked out the PR's fork code with the privileged SYNC_TOKEN and rendered its templates in an unsandboxed Jinja2 environment, so a fork PR author could run code with that token. Fixed by removing the issue_comment trigger in commit 9c0f238 (conda/infrastructure). Only the conda org's own repos are affected; this is not a flaw in the conda package users install.","severity":"critical","cvss":9.9,"epss":0.00451,"exploited":false,"exploited_at":null,"products":[{"name":"conda/infrastructure","fixed":["9c0f23857282ff5cf7a6b3ad6bf0dd6f9974be55"],"affected":"<= ad67db1abc2249b1db5dc4b334be82581e359c84","ecosystem":"github"}],"ecosystems":["github"],"tags":["ci","conda","github-actions","other","pwn-request","supply-chain"],"not_affected_if":["no-issue-comment-trigger","not-conda-org-repos"],"how_to_check":"Only relevant if you run a fork or copy of conda/infrastructure's update.yml. Open .github/workflows/update.yml and look for an 'issue_comment' trigger and 'secrets.SYNC_TOKEN' in a checkout step. Check whether your copy includes 9c0f23857282ff5cf7a6b3ad6bf0dd6f9974be55 (affected: <= ad67db1abc2249b1db5dc4b334be82581e359c84). In the same workflow, look at the pinned conda/actions/template-files@7f6830b (v26.1.0).","fix":"Take conda/infrastructure commit 9c0f23857282ff5cf7a6b3ad6bf0dd6f9974be55, which removes the issue_comment trigger from update.yml. In your own workflows, never check out PR-controlled refs with a PAT in an issue_comment job. Rotate SYNC_TOKEN if the vulnerable workflow ran on your repos; Conda maintainers have not said whether they did.","status":"resolved","published_at":"2026-10-23T15:17:32+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","triaged_at":"2026-10-23T22:31:04+00:00","updated_at":"2026-10-25T12:38:49+00:00","category":"other","confidence":0.85,"triage":{"at":"2026-10-23T22:31:04Z","model":"claude-haiku-5-5","output":{"fix":"Confirm conda/conda includes commit 9c0f238 and that .github/workflows/update.yml matches the patched version.\nIf the commit is missing or the workflow is unchanged, do not run render or recreate comments, and rotate SYNC_TOKEN.","reach":"internet","title":"Conda CI comment trigger lets pull request code reach privileged token","impact":"high","summary":"A comment-triggered GitHub Actions workflow in conda/conda checks out code from a pull request and renders it through an unsandboxed Jinja2 template engine. An attacker who can comment on a pull request can run code in a context that holds the SYNC_TOKEN secret.","category":"other","who_cares":["conda","github-actions","ci"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker-controlled template code runs with SYNC_TOKEN secret access","analyst_note":"Find out whether commit 9c0f238 is in conda/conda and whether SYNC_TOKEN was rotated; the NVD entry is the only source.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["not-conda-org-repos"],"user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"critical"},"cost_usd":0.000992,"input_tokens":3155,"output_tokens":1354,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find out whether commit 9c0f238 is in conda/conda and whether SYNC_TOKEN was rotated; the NVD entry is the only source.","search":"'-2026':13A,16A '-53942':14A,17A '7f6830b1428a9bd47f0b068892c77eae95207037':189C '9c0f238':87B,122C,255C 'action':23B,125C,195C,214C 'affect':97B,136C 'api':174C 'appear':129C 'attack':223C 'attacker-control':222C 'author':71B 'bot':43B,150C,155C 'branch':170C 'central':114C 'chain':30B,232C 'check':46B,175C,205C 'checked-out':204C 'ci':2A,19B 'code':8A,52B,74B,118C 'comment':3A,40B,83B,145C 'commit':86B,121C,254C 'conda':1A,20B,42B,91B,105B,109C,149C,154C 'conda-bot':41B,148C,153C 'conda/actions/template-files':188C 'conda/conda':134C 'conda/infrastructure':18A,35B,88B 'configur':199C 'confirm':211C 'contain':147C 'content':226C 'context':247C 'control':180C,224C 'could':72B 'creat':228C 'cve':12A,15A 'default':198C 'directori':208C 'environ':66B,219C 'event':146C 'extern':191C 'file':194C 'find':212C 'fix':78B 'flaw':102B 'fork':51B,69B 'github':22B,124C 'github-act':21B 'github/workflows/update.yml':139C 'head':167C 'infrastructur':111C,117C 'instal':108B 'issu':82B,144C,249C 'jinja2':65B,218C 'let':5A 'locat':115C 'obtain':163C 'org':92B 'organ':110C 'packag':106B 'patch':252C 'path':160C,238C 'pr':39B,49B,70B,173C,179C 'pr-control':178C 'pr/comment':237C 'present':132C 'prior':119C 'privileg':10A,55B,245C 'pull':6A,165C 'pwn':26B,126C,230C 'pwn-request':25B 'reach':9A,240C 'read':196C 'recreat':156C 'remain':131C 'remov':80B 'render':44B,59B,151C,159C,221C,242C 'repo':95B 'repositori':168C 'repository/ref':181C 'request':7A,27B,127C,166C,231C 'run':73B,187C 'secrets.sync':183C 'suppli':29B 'supply-chain':28B 'sync':56B 'templat':61B,193C,201C,225C,241C 'template-fil':192C 'token':11A,57B,77B,184C,246C 'trigger':4A,37B,84B,142C 'unsandbox':64B,217C 'untrust':236C 'update.yml':32B 'use':182C,215C 'user':107B 'via':253C 'vulner':128C 'work':207C 'workflow':33B,137C,162C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T15:17:32+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-53942","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53942","severity":null,"published_at":"2026-10-23T15:17:32+00:00","modified_at":"2026-10-23T19:42:24+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-53942:244","url":null,"severity":null,"published_at":"2026-10-23T22:31:59+00:00","modified_at":"2026-10-23T22:31:59+00:00","first_seen_at":"2026-10-23T22:31:59+00:00","fetched_at":"2026-10-23T22:31:59+00:00","note":"Primary source GHSA-pf87-fcg3-wjfh (conda/infrastructure). Commit 9c0f238 is in conda/infrastructure (2026-05-19), NOT conda/conda; NVD wording is misleading. Fix removes the issue_comment trigger from update.yml. SYNC_TOKEN rotation: no source says; unknown. No exploitation or PoC found (reporter did not run one)."},{"source":"epss","external_id":"CVE-2026-53942","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-53942","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:49+00:00","fetched_at":"2026-10-25T12:38:49+00:00","note":null}],"documents":[{"id":1500,"url":"https://github.com/conda/infrastructure/security/advisories/GHSA-pf87-fcg3-wjfh","title":"GHSA-pf87-fcg3-wjfh: Pwn Request in update workflow (conda/infrastructure)","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1501,"url":"https://github.com/conda/infrastructure/commit/9c0f23857282ff5cf7a6b3ad6bf0dd6f9974be55","title":"conda/infrastructure 9c0f238: remove issue_comment trigger in update.yml","kind":"release","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}