CVE-2026-114110

Astral uv before 0.11.6 contains a path traversal vulnerability that a...

UBUNTU-CVE-2026-114110

Astral uv before 0.11.6 contains a path traversal vulnerability that a...

Linux Distros Unpatched Vulnerability : CVE-2026-114110

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Astral uv before 0.11.6 contains a path traversal vulnerability that allows attackers to delete arbitrary files by supplying wheels with relative traversal path...

CVE-2025-71437

Astral uv before 0.8.22 contains a path traversal vulnerability in sou...

CVE-2026-114110

A flaw was found in uv. This vulnerability allows an attacker to cause arbitrary file deletion by tricking a user into installing and subsequently uninstalling a specially crafted Python package. The issue occurs because uv fails to properly validate relative file paths listed in the package's...

CVE-2025-71437

A flaw was found in uv. An attacker can perform arbitrary file writes outside the intended directory by providing a malicious source distribution sdist archive. During tar extraction, uv fails to properly validate a crafted sequence of symbolic links, redirecting file writes across the filesystem...

CVE-2026-114109

A flaw was found in uv. An attacker who convinces a user to install a malicious package can achieve arbitrary code execution. Because uv does not properly restrict entry point names, installing a crafted wheel package allows files to be written outside the intended directory, enabling an attacker...

Duplicate Advisory: uv vulnerable to arbitrary file deletion through RECORD entries

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-pjjw-68hj-v9mw. This link is maintained to preserve external references. Original Description Astral uv before 0.11.6 contains a path traversal vulnerability that allows attackers to delete arbitrary files by...

Directory Traversal

Overview uv is an An extremely fast Python package and project manager, written in Rust. Affected versions of this package are vulnerable to Directory Traversal via a symlink sequence during source distribution sdist tar extraction. When a victim installs a malicious sdist, a crafted sequence of...

DEBIAN-CVE-2026-114110

Astral uv before 0.11.6 contains a path traversal vulnerability that allows attackers to delete arbitrary files by supplying wheels with relative traversal paths in RECORD entries. Attackers can craft a malicious wheel whose RECORD references files outside the installation prefix, causing uv to...

CVE-2026-114110

Astral uv before 0.11.6 contains a path traversal vulnerability that allows attackers to delete arbitrary files by supplying wheels with relative traversal paths in RECORD entries. Attackers can craft a malicious wheel whose RECORD references files outside the installation prefix, causing uv to...

DEBIAN-CVE-2026-114109

uv before 0.11.15 contains a path traversal vulnerability that allows malicious wheels to write files outside the scripts directory via crafted consolescripts or guiscripts entry point names. Attackers who induce users to install a malicious wheel can place executables in PATH directories,...

CVE-2026-114109

uv before 0.11.15 contains a path traversal vulnerability that allows malicious wheels to write files outside the scripts directory via crafted consolescripts or guiscripts entry point names. Attackers who induce users to install a malicious wheel can place executables in PATH directories,...

CVE-2025-71437

Astral uv before 0.8.22 contains a path traversal vulnerability in source distribution sdist tar extraction that allows a specially crafted sequence of symlinks to redirect file writes outside the intended extraction prefix. Attackers can publish a malicious sdist that, when installed by a victim...

CVE-2026-114110

Astral uv before 0.11.6 contains a path traversal vulnerability that allows attackers to delete arbitrary files by supplying wheels with relative traversal paths in RECORD entries. Attackers can craft a malicious wheel whose RECORD references files outside the installation prefix, causing uv to...

CVE-2026-114110 Astral uv before 0.11.6 Arbitrary File Deletion via Wheel RECORD Entries

Astral uv before 0.11.6 contains a path traversal vulnerability that allows attackers to delete arbitrary files by supplying wheels with relative traversal paths in RECORD entries. Attackers can craft a malicious wheel whose RECORD references files outside the installation prefix, causing uv to...

CVE-2026-114110 Astral uv before 0.11.6 Arbitrary File Deletion via Wheel RECORD Entries

Astral uv before 0.11.6 contains a path traversal vulnerability that allows attackers to delete arbitrary files by supplying wheels with relative traversal paths in RECORD entries. Attackers can craft a malicious wheel whose RECORD references files outside the installation prefix, causing uv to...

CVE-2026-114110

Astral uv versions before 0.11.6 are vulnerable to a path traversal vulnerability (CWE-23). An attacker can craft a malicious wheel package containing RECORD entries with relative traversal paths. When a user uninstalls the affected package, uv may delete arbitrary files located outside the insta...

CVE-2026-114110 Astral uv before 0.11.6 Arbitrary File Deletion via Wheel RECORD Entries

Astral uv before 0.11.6 contains a path traversal vulnerability that allows attackers to delete arbitrary files by supplying wheels with relative traversal paths in RECORD entries. Attackers can craft a malicious wheel whose RECORD references files outside the installation prefix, causing uv to...

CVE-2026-114110

Astral uv before 0.11.6 contains a path traversal vulnerability that allows attackers to delete arbitrary files by supplying wheels with relative traversal paths in RECORD entries. Attackers can craft a malicious wheel whose RECORD references files outside the installation prefix, causing uv to...