LiveActive security incident?Get immediate response
CVE Record

CVE-2021-42969: Certain Anaconda3 2021.05 are affected by OS command injection.

Certain Anaconda3 2021.05 are affected by OS command injection. When a user installs Anaconda, an attacker can create a new file and write something in usercustomize.py. When the user opens the terminal or activates Anaconda, the command will be executed.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

This CVE describes command execution tied to certain Anaconda3 2021.05 installations. If an attacker can place content in usercustomize.py, it may run when the user opens a terminal or activates Anaconda. Public data is sparse and does not confirm widespread exploitation or a named patch.

Executive priority

Treat this as a targeted hygiene and inventory issue unless additional intelligence shows exploitation. Prioritize developer workstations and shared environments running Anaconda3 2021.05, especially where local file-write controls are weak.

Technical view

The record describes OS command injection through usercustomize.py during or after Anaconda3 2021.05 installation/activation. The attacker prerequisite is file creation or modification capability. No CVSS score, CWE mapping, platform scope, fixed version, or detailed vendor advisory is provided in the supplied sources.

Likely exposure

Exposure appears limited to systems using the affected Anaconda3 2021.05 build where an attacker can write the relevant customization file. The supplied sources do not identify specific operating systems, installer types, package hashes, or enterprise deployment scenarios.

Exploitation context

The source bundle does not report active exploitation, and the CVE is not marked as CISA KEV. The described issue still matters because execution can occur during normal user workflows, but public evidence is incomplete.

Researcher notes

The public record is thin: affected vendor/product fields are n/a, severity is unknown, and the main reference is a DOCX proof report. Assessments should avoid assuming broader Anaconda versions or confirmed fixes without vendor confirmation.

Mitigation direction

  • Inventory systems with Anaconda3 2021.05 installed.
  • Check vendor or Anaconda guidance for fixed builds or advisories.
  • Restrict write access to Python customization locations.
  • Monitor unexpected changes to usercustomize.py.
  • Reinstall or upgrade from trusted vendor media where appropriate.

Validation and detection

  • Confirm whether Anaconda3 2021.05 exists in managed assets.
  • Review relevant usercustomize.py files for unexpected content.
  • Check endpoint telemetry for unusual execution after terminal or Anaconda activation.
  • Verify file permissions prevent untrusted modification.
  • Document any affected systems and remediation status.
Prepared
Confidence
low
Sources
3

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

description · low confidence lookup

Execution behavior lookup

The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2021-42969 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
2Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/an/an/aListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.