{"id":"CVE-2026-114109","title":"uv before 0.11.15 Arbitrary File Write via Entry Point Names","summary":"uv before 0.11.15 contains a path traversal vulnerability that allows malicious wheels to write files outside the scripts directory via crafted console_scripts or gui_scripts entry point names. Attackers who induce users to install a mal…","severity":"high","cvss":8.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvssSource":"cna","cwe":["CWE-22"],"vendor":"astral-sh","product":"uv","affected":["uv < 0.11.15","uv < 0.11.15"],"published":"2026-10-21","updated":"2026-10-21","sourceUpdated":"2026-10-21T00:37:08.897Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-114109","references":[{"url":"https://github.com/astral-sh/uv/security/advisories/GHSA-4gg8-gxpx-9rph","label":"GitHub Security Advisory (GHSA-4gg8-gxpx-9rph)"},{"url":"https://www.vulncheck.com/advisories/uv-before-0.11.15-arbitrary-file-write-via-entry-point-names","label":"VulnCheck Advisory: uv before 0.11.15 Arbitrary File Write via Entry Point Names"}],"tags":["cve.org"],"ingestedAt":"2026-10-21T01:37:08.013Z","slug":"CVE-2026-114109","body":"## Overview\n\nuv before 0.11.15 contains a path traversal vulnerability that allows malicious wheels to write files outside the scripts directory via crafted console_scripts or gui_scripts entry point names. Attackers who induce users to install a malicious wheel can place executables in PATH directories, shadowing or overwriting existing binaries for code execution.\n\n## Affected\n\n- `uv < 0.11.15`\n- `uv < 0.11.15`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":48,"depthScoreParts":{"impact":48.4,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}