CVE-2026-46699

Name of the Vulnerable Software and Affected Versions conda-smithy versions prior to 3.61.0

Description conda-smithy is a tool that combines a conda recipe with configurations to build using freely hosted CI services into a single repository. A flaw in the conda-forge automated webservices allows unintended write access to feedstock repositories via GitHub username takeover. This occurs because mutable GitHub usernames are used as identifiers for repository invitation routing instead of stable, immutable GitHub user IDs.

Recommendations Update to version 3.61.0.