GHSA-v653-r55g-hcmg

Suggest an improvement
Source
https://github.com/advisories/GHSA-v653-r55g-hcmg
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/02/GHSA-v653-r55g-hcmg/GHSA-v653-r55g-hcmg.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-v653-r55g-hcmg
Aliases
Downstream
Published
2026-02-27T09:30:29Z
Modified
2026-03-04T15:12:05.418712Z
Severity
  • 6.3 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H CVSS Calculator
Summary
uv has ZIP payload obfuscation through parsing differentials
Details

A flaw was found in uv. This vulnerability allows an attacker to execute malicious code during package resolution or installation via specially crafted ZIP (Zipped Information Package) archives that exploit parsing differentials, requiring user interaction to install an attacker-controlled package.

Database specific 
{
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-1286"
    ],
    "nvd_published_at": "2026-02-27T08:17:04Z",
    "github_reviewed_at": "2026-03-01T01:03:07Z",
    "severity": "MODERATE"
}
References

Affected packages

crates.io / uv

Package

Name
uv
View open source insights on deps.dev
Purl
pkg:cargo/uv

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
0.9.6

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/02/GHSA-v653-r55g-hcmg/GHSA-v653-r55g-hcmg.json"