uv vulnerabilities

1 known vulnerability in uv from Astral-sh. 1 is rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.8 High severity

  uv: Improper Limitation of a Pathname to a Restricted Directory

  CVE-2026-114109Oct 21, 2026Astral-sh

  uv before 0.11.15 contains a path traversal vulnerability that allows malicious wheels to write files outside the scripts directory via crafted console_scripts or gui_scripts entry point names. Attackers who induce users to install a malicious wheel can place