Alokshresthadev

**Name of the Vulnerable Software and Affected Versions** conda-smithy versions prior to 3.61.0 **Description** conda-smithy is a tool that combines a conda recipe with configurations to build using freely hosted CI services into a single repository. A flaw in the conda-forge automated webservices allows unintended write access to feedstock repositories via GitHub username takeover. This occurs because mutable GitHub usernames are used as identifiers for repository invitation routing instead of stable, immutable GitHub user IDs. **Recommendations** Update to version 3.61.0.