Description
Anaconda3 macOS installers before 2024.06-1 contain a local privilege escalation vulnerability when installed outside the user's home directory. During installation, world-writable files are created and executed with root privileges. This allows a local low-privileged user to inject arbitrary commands, leading to code execution as the root user.
Affected products
anaconda: anaconda3; apple: macos
References2
- m8sec.dev/blog/privilege-escalation-macos-pkg-installers/ ExploitThird Party Advisory
- www.anaconda.com/docs/getting-started/anaconda/release/2024.x#a… Release Notes
Metrics
- CVSS 3.1
-
7.8
HIGH
Score source: CNA
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - EPSS — exploit probability
- 0% percentile: 10 · as of 11 November 2026
- CWE
- CWE-77CWE-732
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.