uv vulnerabilities
CVEs whose affected-version data names the uv package (pip, rust). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
10 CVEsRSS
GHSA-m3wx-qqmx-qxvfHigh· 5.3Duplicate Advisory: uv vulnerable to arbitrary file deletion through RECORD entries
Duplicate Advisory: uv vulnerable to arbitrary file deletion through RECORD entries
CVE-2025-71437Medium· 6.5Astral uv through 0.8.21 Path Traversal via Symlinks in Sdist Tar Extraction
Astral uv before 0.8.22 contains a path traversal vulnerability in source distribution (sdist) tar extraction that allows a specially crafted sequence of symlinks to redirect file writes outside the intended extraction prefix. Attackers …
CVE-2026-114109High· 8.8uv before 0.11.15 Arbitrary File Write via Entry Point Names
uv before 0.11.15 contains a path traversal vulnerability that allows malicious wheels to write files outside the scripts directory via crafted console_scripts or gui_scripts entry point names. Attackers who induce users to install a mal…
PYSEC-2026-4321Noneuv's bundled CA store trusts an emSign root whose intermediate CA keys are compromised
uv's bundled CA store trusts an emSign root whose intermediate CA keys are compromised
GHSA-hq85-5cpj-mr62Criticaluv's bundled CA store trusts an emSign root whose intermediate CA keys are compromised
uv's bundled CA store trusts an emSign root whose intermediate CA keys are compromised
CVE-2026-104843Medium· 5.9uv is a Python package and project manager written in Rust
uv is a Python package and project manager written in Rust. From 0.12.7 until 0.12.18, uv wheel extraction on Windows can process a malicious wheel in a way that writes a file outside the installation prefix, including an executable in a…
CVE-2026-114110Low· 5.3uv vulnerable to arbitrary file deletion through RECORD entries
uv vulnerable to arbitrary file deletion through RECORD entries
GHSA-pjjw-68hj-v9mwLowuv vulnerable to arbitrary file deletion through RECORD entries
uv vulnerable to arbitrary file deletion through RECORD entries
CVE-2025-13327Medium· 6.3uv has ZIP payload obfuscation through parsing differentials
uv has ZIP payload obfuscation through parsing differentials
CVE-2025-54368Mediumuv allows ZIP payload obfuscation through parsing differentials
uv allows ZIP payload obfuscation through parsing differentials