240 matches found
CVE-2026-104843
A flaw was found in uv. An attacker could achieve arbitrary code execution on a Windows system by tricking a user into installing a specially crafted Python wheel package. During archive extraction, files can be written outside the intended target directory, allowing an attacker to place maliciou...
CVE-2026-104843
uv is a Python package and project manager written in Rust. From 0.12.7 until 0.12.18, uv wheel extraction on Windows can process a malicious wheel in a way that writes a file outside the installation prefix, including an executable in a directory already present on the user's PATH. Non-Windows...
CVE-2026-104843 uv: Path traversal on Windows through wheel extraction
uv is a Python package and project manager written in Rust. From 0.12.7 until 0.12.18, uv wheel extraction on Windows can process a malicious wheel in a way that writes a file outside the installation prefix, including an executable in a directory already present on the user's PATH. Non-Windows...
CVE-2026-104843
The Python package and project manager uv (written in Rust) is vulnerable to a path traversal flaw during wheel extraction on Windows systems. Affected versions range from 0.12.7 until 0.12.18 . An attacker can trick a user into installing a specially crafted Python wheel package that, during ext...
EUVD-2026-91675
uv is a Python package and project manager written in Rust. From 0.12.7 until 0.12.18, uv wheel extraction on Windows can process a malicious wheel in a way that writes a file outside the installation prefix, including an executable in a directory already present on the user's PATH. Non-Windows...
CVE-2026-104843 uv: Path traversal on Windows through wheel extraction
uv is a Python package and project manager written in Rust. From 0.12.7 until 0.12.18, uv wheel extraction on Windows can process a malicious wheel in a way that writes a file outside the installation prefix, including an executable in a directory already present on the user's PATH. Non-Windows...
CVE-2026-104843
uv is a Python package and project manager written in Rust. From 0.12.7 until 0.12.18, uv wheel extraction on Windows can process a malicious wheel in a way that writes a file outside the installation prefix, including an executable in a directory already present on the user's PATH. Non-Windows...
[SECURITY] Fedora 44 Update: uv-0.12.19-1.fc44
An extremely fast Python package and project manager, written in Rust. Highlights: =E2=80=A2 A single tool to replace pip, pip-tools, pipx, poetry, pyenv, twi ne, virtualenv, and more. =E2=80=A2 10-100x faster than pip. =E2=80=A2 Provides comprehensive project management, with a universal lockf...
[SECURITY] Fedora 44 Update: python-uv-build-0.12.19-1.fc44
This package is a slimmed down version of uv containing only the build backend...
[SECURITY] Fedora 43 Update: uv-0.12.19-1.fc43
An extremely fast Python package and project manager, written in Rust. Highlights: =E2=80=A2 A single tool to replace pip, pip-tools, pipx, poetry, pyenv, twi ne, virtualenv, and more. =E2=80=A2 10-100x faster than pip. =E2=80=A2 Provides comprehensive project management, with a universal lockf...
[SECURITY] Fedora 43 Update: python-uv-build-0.12.19-1.fc43
This package is a slimmed down version of uv containing only the build backend...
OPENSUSE-SU-2026:11841-1 python313-uv-0.12.17-1.1 on GA media
These are all security issues fixed in the python313-uv-0.12.17-1.1 package on the GA media of openSUSE Tumbleweed...
Astra Linux – Vulnerability in libuv1
Node.js versions prior to 16.4.1, 14.17.2, and 12.22.2 are vulnerable to an out-of-bounds read when the uvidnatoascii function is used to convert strings to ASCII. The pointer p is read and incremented without checking whether it lies beyond pe, where pe holds a pointer to the end of the buffer...
python313-uv-0.12.7-1.1 on GA media (moderate)
python313-uv-0.12.7-1.1 on GA media Announcement ID: openSUSE-SU-2026:11635-1 Rating: moderate Cross-References: CVE-2026-25800 CVSS scores: CVE-2026-25800 SUSE : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Affected Products: openSUSE Tumbleweed An update that solves one vulnerability can no...
OPENSUSE-SU-2026:11635-1 python313-uv-0.12.7-1.1 on GA media
These are all security issues fixed in the python313-uv-0.12.7-1.1 package on the GA media of openSUSE Tumbleweed...
GO-2025-3678 vulnerabilities
Vulnerabilities for packages: wasmtime, uv, wasm-pack, qdrant, rustup, oranda, pixi, sccache, wasmcloud, samply, zizmor, sqlx, xh, ntpd-rs, kdash, sdp-k8s-injector, deno, lychee, linkerd-extension-init, nushell, rustls-ffi, parseable, linkerd2-proxy, wash, rye, wadm, atuin, shadowsocks-rust,...
[SECURITY] Fedora 44 Update: python-uv-build-0.11.28-1.fc44
This package is a slimmed down version of uv containing only the build backend...
[SECURITY] Fedora 43 Update: uv-0.11.28-1.fc43
An extremely fast Python package and project manager, written in Rust. Highlights: =E2=80=A2 A single tool to replace pip, pip-tools, pipx, poetry, pyenv, twi ne, virtualenv, and more. =E2=80=A2 10-100x faster than pip. =E2=80=A2 Provides comprehensive project management, with a universal lockf...
