5.9
Moyenne
CVE-2026-104843 uv is a Python package and project manager written in Rust
Description
uv is a Python package and project manager written in Rust. From 0.12.7 until 0.12.18, uv wheel extraction on Windows can process a malicious wheel in a way that writes a file outside the installation prefix, including an executable in a directory already present on the user's PATH. Non-Windows hosts are not affected. This issue is fixed in version 0.12.18.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| uv 0.12 | 0.12.7 → < 0.12.18 | 0.12.18 |
Références
- github.com github.com
- github.com github.com
- github.com github.com
- github.com github.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de uv
Les 6 CVE de uv →
CVE-2026-114110
Astral uv before 0.11.6 contains a path traversal vulnerability that allows attackers to delete arbitrary files by…
8.7
Élevée
CVE-2026-114109
uv before 0.11.15 contains a path traversal vulnerability that allows malicious wheels to write files outside the…
8.7
Élevée
CVE-2025-71437
Astral uv before 0.8.22 contains a path traversal vulnerability in source distribution (sdist) tar extraction that…
8.7
Élevée
CVE-2025-13327
Uv: uv: specially crafted zip archives lead to arbitrary code execution due to parsing differentials
6.3
Moyenne