Astral-sh vulnerabilities
We track 2 vulnerabilities in Astral-sh products across 2 products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on October 21, 2026.
2vulnerabilities
0critical
2high
0exploited
8.4average CVSS score
Latest Astral-sh vulnerabilities
- 8.8 High severity
uv: Improper Limitation of a Pathname to a Restricted Directory
uv before 0.11.15 contains a path traversal vulnerability that allows malicious wheels to write files outside the scripts directory via crafted console_scripts or gui_scripts entry point names. Attackers who induce users to install a malicious wheel can place
- 8.1 High severity
tokio-tar: Access of Resource Using Incompatible Type
astral-tokio-tar is a tar archive reading/writing library for async Rust. Versions of astral-tokio-tar prior to 0.5.6 contain a boundary parsing vulnerability that allows attackers to smuggle additional archive entries by exploiting inconsistent PAX/ustar head