Directory Traversal Affecting pixi package, versions <0.81.0-r0
Threat Intelligence
The probability is the direct output of the EPSS model, and conveys an overall sense of the threat of exploitation in the wild. The percentile measures the EPSS probability relative to all known EPSS scores. Note: This data is updated daily, relying on the latest available EPSS model version. Check out the EPSS documentation for more details.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-WOLFILATEST-PIXI-19828092
- published16 Sept 2026
- disclosed9 Sept 2026
Introduced: 9 Sep 2026
CVE-2026-53956 (opens in a new tab)How to fix?
Upgrade Wolfi pixi to version 0.81.0-r0 or higher.
NVD Description
Note: Versions mentioned in the description apply only to the upstream pixi package and not the pixi package as distributed by Wolfi.
See How to fix? for Wolfi relevant fixed versions and status.
Rattler is a library that provides common functionality used within the conda ecosystem. rattler_cache prior to version 0.9.0 and py-rattler prior to version 0.24.0 were vulnerable to package-cache path traversal when handling package metadata from conda channels. During cache materialization, the ratter_cache code used the package record build string as part of a cache key that was joined into a filesystem path. A malicious or untrusted channel could publish repodata with path separators or traversal components in that field, causing package contents to be written outside the configured package cache directory. The issue requires use of a malicious or otherwise untrusted conda channel. Curated channels that validate package metadata are not expected to allow malformed build strings of this form. Users should upgrade to rattler_cache version 0.9.0 or py-rattler version 0.24.0 and avoid untrusted conda channels.