Skip to content
cve.newCreate a CVE report

uv

Follow this package

Get the evidence behind this dependency. Browse imported advisories below, or check an exact version against OSV now. View source coverage.

Check the version you ship.

Get a fresh OSV lookup for an exact release. We send the package name and version to OSV without storing a report.

Advisories & recorded fixes

high8.8
CVE-2026-114109

uv before 0.11.15 Arbitrary File Write via Entry Point Names

uv before 0.11.15 contains a path traversal vulnerability that allows malicious wheels to write files outside the scripts directory via crafted console_scripts or gui_scripts entry point names. Attackers who induce users to install a malicious wheel can place executables in PATH directories, shadowing or overwriting existing binaries for code execution.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

astral-sh · uv / astral-sh · uv
medium6.3
CVE-2025-13327Package fixes recorded

Uv: uv: specially crafted zip archives lead to arbitrary code execution due to parsing differentials

A flaw was found in uv. This vulnerability allows an attacker to execute malicious code during package resolution or installation via specially crafted ZIP (Zipped Information Package) archives that exploit parsing differentials, requiring user interaction to install an attacker-controlled package.

Recorded fixes — uv: 0.9.6. Check your release branch.

Exploitation not established

crates.io / uv
uv crates.io
Affected range Recorded fix
Earlier releases before 0.9.6Semantic versions0.9.6

Version evidence: OSV · GHSA-v653-r55g-hcmg

View original version evidence
{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "0.9.6"
        }
      ],
      "type": "SEMVER"
    }
  ],
  "versions": []
}