---
id: "CVE-2026-53942"
kind: "vulnerability"
aliases: ["CVE-2026-53942"]
title: "Conda CI comment trigger lets pull request code reach privileged token"
severity: "critical"
cvss: 9.9
epss: 0.00451
exploited: false
status: "resolved"
category: "other"
products: [{"name": "conda/infrastructure", "fixed": ["9c0f23857282ff5cf7a6b3ad6bf0dd6f9974be55"], "affected": "<= ad67db1abc2249b1db5dc4b334be82581e359c84", "ecosystem": "github"}]
ecosystems: ["github"]
tags: ["ci", "conda", "github-actions", "other", "pwn-request", "supply-chain"]
not_affected_if: ["no-issue-comment-trigger", "not-conda-org-repos"]
published_at: "2026-10-23T15:17:32+00:00"
first_seen_at: "2026-10-23T21:57:34+00:00"
updated_at: "2026-10-25T12:38:49+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53942", "first_seen_at": "2026-10-23T21:57:34+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T22:31:59+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-53942", "first_seen_at": "2026-10-25T12:38:49+00:00"}]
---

# Conda CI comment trigger lets pull request code reach privileged token

The update.yml workflow in conda/infrastructure was triggered by PR comments ('@conda-bot render'). It checked out the PR's fork code with the privileged SYNC_TOKEN and rendered its templates in an unsandboxed Jinja2 environment, so a fork PR author could run code with that token. Fixed by removing the issue_comment trigger in commit 9c0f238 (conda/infrastructure). Only the conda org's own repos are affected; this is not a flaw in the conda package users install.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- github:conda/infrastructure affected <= ad67db1abc2249b1db5dc4b334be82581e359c84 fixed 9c0f23857282ff5cf7a6b3ad6bf0dd6f9974be55

## How to check

Only relevant if you run a fork or copy of conda/infrastructure's update.yml. Open .github/workflows/update.yml and look for an 'issue_comment' trigger and 'secrets.SYNC_TOKEN' in a checkout step. Check whether your copy includes 9c0f23857282ff5cf7a6b3ad6bf0dd6f9974be55 (affected: <= ad67db1abc2249b1db5dc4b334be82581e359c84). In the same workflow, look at the pinned conda/actions/template-files@7f6830b (v26.1.0).

## Fix

Take conda/infrastructure commit 9c0f23857282ff5cf7a6b3ad6bf0dd6f9974be55, which removes the issue_comment trigger from update.yml. In your own workflows, never check out PR-controlled refs with a PAT in an issue_comment job. Rotate SYNC_TOKEN if the vulnerable workflow ran on your repos; Conda maintainers have not said whether they did.

## Timeline

- 2026-10-23T21:57:34+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-53942
- 2026-10-23T22:31:59+00:00 analyst — Primary source GHSA-pf87-fcg3-wjfh (conda/infrastructure). Commit 9c0f238 is in conda/infrastructure (2026-05-19), NOT conda/conda; NVD wording is misleading. Fix removes the issue_comment trigger from update.yml. SYNC_TOKEN rotation: no source says; unknown. No exploitation or PoC found (reporter did not run one).
- 2026-10-25T12:38:49+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-53942

## Documents

- [advisory] GHSA-pf87-fcg3-wjfh: Pwn Request in update workflow (conda/infrastructure) https://github.com/conda/infrastructure/security/advisories/GHSA-pf87-fcg3-wjfh
- [fix] conda/infrastructure 9c0f238: remove issue_comment trigger in update.yml https://github.com/conda/infrastructure/commit/9c0f23857282ff5cf7a6b3ad6bf0dd6f9974be55

## From the sources

Conda Organization Infrastructure is a centralized location for infrastructure codes. Prior to commit 9c0f238, a GitHub Actions Pwn Request vulnerability appears to remain present in conda/conda. The affected workflow is .github/workflows/update.yml. It is triggered by issue_comment events containing @conda-bot render or @conda-bot recreate. For the render path, the workflow obtains the pull request head repository and branch from the PR API, checks out that PR-controlled repository/ref using secrets.SYNC_TOKEN, and then runs conda/actions/template-files@7f6830b1428a9bd47f0b068892c77eae95207037. The external template-files action reads its default configuration and templates from the checked-out working directory. In the confirmed finding, that action uses an unsandboxed Jinja2 environment to render attacker-controlled template content. This creates a Pwn Request chain in which an untrusted PR/comment path can reach template rendering in a privileged token context. This issue has been patched via commit 9c0f238.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_