Skip to content
OpenAdvisories

Package · Ubuntu

uv

4 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Medium 5.3
    CVE-2026-114110

    Astral uv before 0.11.6 Arbitrary File Deletion via Wheel RECORD Entries

    Astral uv before 0.11.6 contains a path traversal vulnerability that allows attackers to delete arbitrary files by supplying wheels with relative traversal paths in RECORD entries. Attackers can craft a malicious wheel whose RECORD references files outside th…

    astral-sh uv uv uv Debian Ubuntu PyPI
  • Medium 6.5
    CVE-2025-71437

    Astral uv through 0.8.21 Path Traversal via Symlinks in Sdist Tar Extraction

    Astral uv before 0.8.22 contains a path traversal vulnerability in source distribution (sdist) tar extraction that allows a specially crafted sequence of symlinks to redirect file writes outside the intended extraction prefix. Attackers can publish a maliciou…

    astral-sh uv uv Ubuntu
  • Medium 5.9
    CVE-2026-104843

    uv: Path traversal on Windows through wheel extraction

    uv is a Python package and project manager written in Rust. From 0.12.7 until 0.12.18, uv wheel extraction on Windows can process a malicious wheel in a way that writes a file outside the installation prefix, including an executable in a directory already pre…

    astral-sh uv uv uv Ubuntu PyPI crates.io