Skip to content
fr Sign in
6.3 Medium

CVE-2025-13327 Uv: uv: specially crafted zip archives lead to arbitrary code execution due to parsing differentials

Description

A flaw was found in uv. This vulnerability allows an attacker to execute malicious code during package resolution or installation via specially crafted ZIP (Zipped Information Package) archives that exploit parsing differentials, requiring user interaction to install an attacker-controlled package.

CVSS 3.1 detail

Vector CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H

Exploitable with local access to the machine, with an administrator account and if a user takes an action; an attacker can seriously compromise confidentiality, integrity or availability.

Attack vector
Local
Attack complexity
High
Privileges required
High
Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Affected products and versions

Product Affected versions Fixed in
uv 0.9 earliest → < 0.9.6 0.9.6
Red Hat AI Inference Server Versions not published
Red Hat OpenShift AI (RHOAI) Versions not published
Red Hat OpenShift AI 3.0 1793328358 earliest → < 1793328358 1793328358

References

Timeline

  1. Published
  2. Last modified

Other CVEs of uv

The 6 CVEs of uv →
CVE-2026-114110 Astral uv before 0.11.6 contains a path traversal vulnerability that allows attackers to delete arbitrary files by… 8.7 High CVE-2026-114109 uv before 0.11.15 contains a path traversal vulnerability that allows malicious wheels to write files outside the… 8.7 High CVE-2025-71437 Astral uv before 0.8.22 contains a path traversal vulnerability in source distribution (sdist) tar extraction that… 8.7 High CVE-2026-104843 uv is a Python package and project manager written in Rust 5.9 Medium
Track this CVE