CVE-2025-13327Medium· 6.3▾ Sunlituv has ZIP payload obfuscation through parsing differentials
▾ Sunlit zone — Low / medium · no exploitation signal
impact 34.7 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 1.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
0.1%
Last analysed / modified upstream
0.1% → 0.2%
— → 6.3
A flaw was found in uv. This vulnerability allows an attacker to execute malicious code during package resolution or installation via specially crafted ZIP (Zipped Information Package) archives that exploit parsing differentials, requiring user interaction to install an attacker-controlled package.
uv < 0.9.6Upgrade to a patched release:
uv 0.9.6Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
PYSEC-2026-4321Noneuv's bundled CA store trusts an emSign root whose intermediate CA keys are compromised
CVE-2026-114109High· 8.8uv before 0.11.15 Arbitrary File Write via Entry Point Names
CVE-2026-114110Low· 5.3uv vulnerable to arbitrary file deletion through RECORD entries
GHSA-hq85-5cpj-mr62Criticaluv's bundled CA store trusts an emSign root whose intermediate CA keys are compromised
CVE-2026-104843Medium· 5.9uv is a Python package and project manager written in Rust
GHSA-pjjw-68hj-v9mwLowuv vulnerable to arbitrary file deletion through RECORD entries