CVE-2024-46062

HighCVSS 7.8/10Last modified Oct 27, 2026

Description

Miniconda3 macOS installers before 23.11.0-1 contain a local privilege escalation vulnerability when installed outside the user's home directory. During installation, world-writable files are created and executed with root privileges. This flaw allows a local low-privileged user to inject arbitrary commands, leading to code execution as the root user.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-77 CWE-732

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://m8sec.dev/blog/privilege-escalation-macos-pkg-installers/Exploit, Third Party Advisory
https://www.anaconda.com/docs/getting-started/miniconda/release/23.x#miniconda-23-11-0-1Release Notes

Timeline

Published: Dec 17, 2025
Last modified: Oct 27, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-46077.8Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture K CVE-2024-460736.1A reflected Cross-Site Scripting (XSS) vulnerability exists in the login page of IceHRM v32.4.0.OS. The vulnerability is due to improper san CVE-2024-460769.8RuoYi v4.7.9 and before has a security flaw that allows escaping from comments within the code generation feature, enabling the injection of CVE-2024-460775.4itsourcecode Online Tours and Travels Management System v1.0 is vulnerable to Cross Site Scripting (XSS) via a crafted payload to the val-us CVE-2024-460787.5itsourcecode Sports Management System Project 1.0 is vulnerable to SQL Injection in the function delete_category of the file sports_scheduli CVE-2024-460796.1Scriptcase v9.10.023 and before is vulnerable to Cross Site Scripting (XSS) in proj_new.php via the Descricao parameter.CVE-2024-46085.4The SellKit – Funnel builder and checkout optimizer for WooCommerce to sell more, faster plugin for WordPress is vulnerable to Stored Cross-CVE-2024-460808.0Scriptcase v9.10.023 and before is vulnerable to Remote Code Execution (RCE) via the nm_zip function.CVE-2024-460815.4Scriptcase v9.10.023 and before is vulnerable to Cross Site Scripting (XSS). An authenticated user can craft malicious payloads in the To-Do CVE-2024-460825.4Scriptcase v.9.10.023 and before is vulnerable to Cross Site Scripting (XSS) in nm_cor.php via the form and field parameters.CVE-2024-460835.4Scriptcase v9.10.023 and before is vulnerable to Cross Site Scripting (XSS). An authenticated user can craft malicious payloads using the me CVE-2024-460848.0Scriptcase 9.10.023 and before is vulnerable to Remote Code Execution (RCE) via the nm_unzip function.