Aller au contenu
en Se connecter
6.8 Moyenne

CVE-2025-54368 uv is a Python package and project manager written in Rust

Description

uv is a Python package and project manager written in Rust. In versions 0.8.5 and earlier, remote ZIP archives were handled in a streamwise fashion, and file entries were not reconciled against the archive's central directory. An attacker could contrive a ZIP archive that would extract with legitimate contents on some package installers, and malicious contents on others due to multiple local file entries. An attacker could also contrive a "stacked" ZIP input with multiple internal ZIPs, which would be handled differently by different package installers. The attacker could choose which installer to target in both scenarios. This issue is fixed in version 0.8.6. To work around this issue, users may choose to set UV_INSECURE_NO_ZIP_VALIDATION=1 to revert to the previous behavior.

Produits et versions touchés

Produit Versions touchées Corrigé en
uv 0.8 premières → < 0.8.6 0.8.6

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de uv

Les 6 CVE de uv →
CVE-2026-114110 Astral uv before 0.11.6 contains a path traversal vulnerability that allows attackers to delete arbitrary files by… 8.7 Élevée CVE-2026-114109 uv before 0.11.15 contains a path traversal vulnerability that allows malicious wheels to write files outside the… 8.7 Élevée CVE-2025-71437 Astral uv before 0.8.22 contains a path traversal vulnerability in source distribution (sdist) tar extraction that… 8.7 Élevée CVE-2026-104843 uv is a Python package and project manager written in Rust 5.9 Moyenne
Suivre cette CVE