---
id: CVE-2026-114109
title: uv before 0.11.15 Arbitrary File Write via Entry Point Names
summary: >-
  uv before 0.11.15 contains a path traversal vulnerability that allows
  malicious wheels to write files outside the scripts directory via crafted
  console_scripts or gui_scripts entry point names. Attackers who induce users
  to install a mal…
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-22
vendor: astral-sh
product: uv
affected:
  - uv < 0.11.15
  - uv < 0.11.15
published: '2026-10-21'
updated: '2026-10-21'
sourceUpdated: '2026-10-21T00:37:08.897Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-114109'
references:
  - url: 'https://github.com/astral-sh/uv/security/advisories/GHSA-4gg8-gxpx-9rph'
    label: GitHub Security Advisory (GHSA-4gg8-gxpx-9rph)
  - url: >-
      https://www.vulncheck.com/advisories/uv-before-0.11.15-arbitrary-file-write-via-entry-point-names
    label: >-
      VulnCheck Advisory: uv before 0.11.15 Arbitrary File Write via Entry Point
      Names
tags:
  - cve.org
ingestedAt: '2026-10-21T01:37:08.013Z'
---

## Overview

uv before 0.11.15 contains a path traversal vulnerability that allows malicious wheels to write files outside the scripts directory via crafted console_scripts or gui_scripts entry point names. Attackers who induce users to install a malicious wheel can place executables in PATH directories, shadowing or overwriting existing binaries for code execution.

## Affected

- `uv < 0.11.15`
- `uv < 0.11.15`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.