Skip to content
fr Sign in
5.9 Medium

CVE-2026-104843 uv is a Python package and project manager written in Rust

Description

uv is a Python package and project manager written in Rust. From 0.12.7 until 0.12.18, uv wheel extraction on Windows can process a malicious wheel in a way that writes a file outside the installation prefix, including an executable in a directory already present on the user's PATH. Non-Windows hosts are not affected. This issue is fixed in version 0.12.18.

Affected products and versions

Product Affected versions Fixed in
uv 0.12 0.12.7 → < 0.12.18 0.12.18

References

Timeline

  1. Published
  2. Last modified

Other CVEs of uv

The 6 CVEs of uv →
CVE-2026-114110 Astral uv before 0.11.6 contains a path traversal vulnerability that allows attackers to delete arbitrary files by… 8.7 High CVE-2026-114109 uv before 0.11.15 contains a path traversal vulnerability that allows malicious wheels to write files outside the… 8.7 High CVE-2025-71437 Astral uv before 0.8.22 contains a path traversal vulnerability in source distribution (sdist) tar extraction that… 8.7 High CVE-2025-13327 Uv: uv: specially crafted zip archives lead to arbitrary code execution due to parsing differentials 6.3 Medium
Track this CVE