CVE-2026-114110

Astral uv versions before 0.11.6 are vulnerable to a path traversal vulnerability (CWE-23). An attacker can craft a malicious wheel package containing RECORD entries with relative traversal paths. When a user uninstalls the affected package, uv may delete arbitrary files located outside the insta...

EUVD-2026-106913

Astral uv before 0.11.6 contains a path traversal vulnerability that allows attackers to delete arbitrary files by supplying wheels with relative traversal paths in RECORD entries. Attackers can craft a malicious wheel whose RECORD references files outside the installation prefix, causing uv to...

CVE-2025-71437

The Astral uv package version 0.8.21 and earlier is vulnerable to a path traversal vulnerability during the extraction of source distribution (sdist) tar files. The root cause is a flaw where a specially crafted sequence of symlinks can be used to redirect file writes outside of the intended extr...

EUVD-2025-211142

Astral uv before 0.8.22 contains a path traversal vulnerability in source distribution sdist tar extraction that allows a specially crafted sequence of symlinks to redirect file writes outside the intended extraction prefix. Attackers can publish a malicious sdist that, when installed by a victim...