PYSEC-2026-4305
See a problem?- Import Source
- https://github.com/pypa/advisory-database/blob/main/vulns/uv/PYSEC-2026-4305.yaml
- JSON Data
- https://api.osv.dev/v1/vulns/PYSEC-2026-4305
- Aliases
- Published
- 2026-10-15T10:22:45Z
- Modified
- 2026-10-15T14:45:14Z
- Severity
-
- 5.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator
- Summary
- uv: Path traversal on Windows through wheel extraction
- Details
-
Impact
In versions of uv from 0.12.7 to 0.12.18 on Windows, uv could be induced into writing a file outside of the installation prefix during wheel installation.
A malicious wheel could use this to place an executable outside of the intended environment, including in a directory already present on the user's PATH.
This vulnerability only affects Windows hosts; no other platforms are affected.
Patches
uv 0.12.18 and newer address this vulnerability. Users are encouraged to upgrade to 0.12.18.
Workarounds
There is no workaround other than upgrading to uv 0.12.18.
- References
-
- https://github.com/astral-sh/uv/security/advisories/GHSA-2cv4-cqwr-gwf7
- https://nvd.nist.gov/vuln/detail/CVE-2026-104843
- https://github.com/astral-sh/uv/pull/21923
- https://github.com/astral-sh/uv/commit/67169645278ce082638d619beefa6d062540843b
- https://github.com/astral-sh/uv
- https://github.com/astral-sh/uv/releases/tag/0.12.18
- https://pypi.org/project/uv
- https://github.com/advisories/GHSA-2cv4-cqwr-gwf7
Affected packages
PyPI / uv
Package
- Name
- uv
- View open source insights on deps.dev
- Purl
- pkg:pypi/uv