CVE-2025-49842 Details

A vulnerability exists in the conda-forge-webservices Docker container, which runs commands as the root user by default. This behavior, present in versions through 2025.3.23, heightens the risk of privilege escalation and potential host compromise if another vulnerability is exploited. The issue arises because the container executes commands without specifying a user, allowing for unauthorized access or actions to be performed with elevated privileges.

Users can upgrade to version 2025.3.24 or later. If an immediate upgrade is not possible, a dedicated non-root user should be created, granted only the necessary permissions, and explicitly set as the container's runtime user to mitigate the risk of privilege escalation.