AIKIDO-2026-737163

TL;DR

parse_entry_point_def only rsplits and strips a noarch Python entry-point definition, then CreatePythonEntryPointAction interpolates the resulting command into {BIN_DIRECTORY}/{command} with a no-op verify(). A malicious noarch:python package can put .., /, \, or an absolute path in info/link.json so conda writes an executable wrapper outside the prefix or overwrites an in-prefix entry point such as pip. That write happens on the default path of conda install and related transactions, so a later invocation of the overwritten command runs attacker-controlled Python. The fix rejects entry-point names that are not a simple file name before generating the wrapper scripts.