Skip to content
OpenAdvisories

Vendor

astral-sh

9 known vulnerabilities.

Products

uv 6 tokio-tar 3
All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • Medium 5.3
    CVE-2026-114110

    Astral uv before 0.11.6 Arbitrary File Deletion via Wheel RECORD Entries

    Astral uv before 0.11.6 contains a path traversal vulnerability that allows attackers to delete arbitrary files by supplying wheels with relative traversal paths in RECORD entries. Attackers can craft a malicious wheel whose RECORD references files outside th…

    astral-sh uv uv uv Debian Ubuntu PyPI
  • Medium 6.5
    CVE-2025-71437

    Astral uv through 0.8.21 Path Traversal via Symlinks in Sdist Tar Extraction

    Astral uv before 0.8.22 contains a path traversal vulnerability in source distribution (sdist) tar extraction that allows a specially crafted sequence of symlinks to redirect file writes outside the intended extraction prefix. Attackers can publish a maliciou…

    astral-sh uv uv Ubuntu
  • Medium 5.9
    CVE-2026-104843

    uv: Path traversal on Windows through wheel extraction

    uv is a Python package and project manager written in Rust. From 0.12.7 until 0.12.18, uv wheel extraction on Windows can process a malicious wheel in a way that writes a file outside the installation prefix, including an executable in a directory already pre…

    astral-sh uv uv uv Ubuntu PyPI crates.io
  • Medium 6.3
    CVE-2025-13327

    Uv: uv: specially crafted zip archives lead to arbitrary code execution due to parsing differentials

    A flaw was found in uv. This vulnerability allows an attacker to execute malicious code during package resolution or installation via specially crafted ZIP (Zipped Information Package) archives that exploit parsing differentials, requiring user interaction to…

    Red Hat astral-sh Red Hat OpenShift AI (RHOAI) Red Hat OpenShift AI 3.0 PyPI crates.io
  • Medium 6.1
    CVE-2025-59825

    astral-tokio-tar has a path traversal in tar extraction

    astral-tokio-tar is a tar archive reading/writing library for async Rust. In versions 0.5.3 and earlier of astral-tokio-tar, tar archives may extract outside of their intended destination directory when using the Entry::unpack_in_raw API. Additionally, the En…

    astral-sh tokio-tar astral-tokio-tar rust-astral-tokio-tar Debian Ubuntu crates.io
  • Medium 6.8
    CVE-2025-54368

    uv is vulnerable to ZIP payload obfuscation through parsing differentials

    uv is a Python package and project manager written in Rust. In versions 0.8.5 and earlier, remote ZIP archives were handled in a streamwise fashion, and file entries were not reconciled against the archive's central directory. An attacker could contrive a ZIP…

    astral-sh uv uv PyPI