CVE-2025-71437Medium· 6.5▾ SunlitAstral uv before 0.8.22 contains a path traversal vulnerability in source distribution (sdist) tar extraction that allows a specially crafted sequence of symlinks to redirect file writes outside the intended extraction prefix. Attackers …
▾ Sunlit zone — Low / medium · no exploitation signal
impact 35.8 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Oct 21.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.3%
0.3% → 0.3%
Astral uv before 0.8.22 contains a path traversal vulnerability in source distribution (sdist) tar extraction that allows a specially crafted sequence of symlinks to redirect file writes outside the intended extraction prefix. Attackers can publish a malicious sdist that, when installed by a victim, writes arbitrary files to filesystem locations outside the installation prefix.
uv <= 0.8.21Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-114109High· 8.8uv before 0.11.15 Arbitrary File Write via Entry Point Names
CVE-2026-114110Low· 5.3uv vulnerable to arbitrary file deletion through RECORD entries
CVE-2026-104843Medium· 5.9uv is a Python package and project manager written in Rust
GHSA-m3wx-qqmx-qxvfHigh· 5.3Duplicate Advisory: uv vulnerable to arbitrary file deletion through RECORD entries
PYSEC-2026-4321Noneuv's bundled CA store trusts an emSign root whose intermediate CA keys are compromised
GHSA-hq85-5cpj-mr62Criticaluv's bundled CA store trusts an emSign root whose intermediate CA keys are compromised