The conda rattler library's EntryPoint::FromStr function in rattler_conda_types prior to version 0.43.2 performs only a trim operation on the command field before concatenating it with the install prefix and writing an executable Python script. A malicious noarch:python package can craft an info/link.json entry-point name containing path traversal characters (e.g., '..', '/', '\', or absolute paths), causing the resulting file to be written outside the intended prefix directory or overwrite existing entry-points such as bin/pip. This vulnerability affects default install paths used by pixi install, mamba install via py-rattler, rattler-build, and other consumers of the rattler install crate. The issue is fixed in version 0.43.2.

An attacker can create a malicious package that exploits this vulnerability to write files outside the intended installation directory, potentially overwriting critical executables or scripts. This could lead to arbitrary code execution or disruption of the conda environment. The CVSS 4.0 base score is 6.9 (medium severity), reflecting local attack vector, low complexity, no privileges required, no user interaction, but high impact on integrity.

Upgrade to conda rattler version 0.43.2 or later, where this path traversal vulnerability is fixed. No other flags or post-link script options are required to mitigate this issue. Patch status is confirmed by the vendor stating the fix is included in version 0.43.2.