uv allows ZIP payload obfuscation through parsing differentials

ImpactIn versions 0.8.5 and earlier of uv, remote ZIP archives were handled in a streamwise fashion, and file entries were not reconciled against the archive's central directory. This enabled two parser differentials against other Python package installers:1. An attacker could contrive a ZIP...