What’s Vulnerable › Products

astral-sh uv vulnerabilities

6 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 6 published in the last 12 months.

Check whether your astral-sh uv version is affected

Latest astral-sh uv vulnerabilities

• CVE-2026-114110 — Astral uv before 0.11.6 Arbitrary File Deletion via Wheel RECORD Entries (CVSS 5.3)
• CVE-2025-71437 — Astral uv through 0.8.21 Path Traversal via Symlinks in Sdist Tar Extraction (CVSS 6.5)
• CVE-2026-114109 — uv before 0.11.15 Arbitrary File Write via Entry Point Names (CVSS 8.8)
• CVE-2026-104843 — uv: Path traversal on Windows through wheel extraction (CVSS 5.9)
• CVE-2025-13327 — Uv: uv: specially crafted zip archives lead to arbitrary code execution due to parsing differentials (CVSS 6.3)
• CVE-2025-54368 — uv is vulnerable to ZIP payload obfuscation through parsing differentials (CVSS 6.8)