CVE-2026-114109High· 8.8▾ Twilightuv before 0.11.15 contains a path traversal vulnerability that allows malicious wheels to write files outside the scripts directory via crafted console_scripts or gui_scripts entry point names. Attackers who induce users to install a mal…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 48.4 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
uv before 0.11.15 contains a path traversal vulnerability that allows malicious wheels to write files outside the scripts directory via crafted console_scripts or gui_scripts entry point names. Attackers who induce users to install a malicious wheel can place executables in PATH directories, shadowing or overwriting existing binaries for code execution.
uv < 0.11.15uv < 0.11.15Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2025-71437Medium· 6.5Astral uv through 0.8.21 Path Traversal via Symlinks in Sdist Tar Extraction
CVE-2026-104843Medium· 5.9uv is a Python package and project manager written in Rust
CVE-2026-114110Medium· 5.3Astral uv before 0.11.6 Arbitrary File Deletion via Wheel RECORD Entries
GHSA-hq85-5cpj-mr62Criticaluv's bundled CA store trusts an emSign root whose intermediate CA keys are compromised
GHSA-pjjw-68hj-v9mwLowuv vulnerable to arbitrary file deletion through RECORD entries
CVE-2025-13327Mediumuv allows ZIP payload obfuscation through parsing differentials