CVE-2025-71437

A flaw was found in uv. An attacker can perform arbitrary file writes outside the intended directory by providing a malicious source distribution sdist archive. During tar extraction, uv fails to properly validate a crafted sequence of symbolic links, redirecting file writes across the filesystem...