PYSEC-2026-4305
uv: Path traversal on Windows through wheel extraction
At a glance
- Published
- Updated
- CVE
- CVE-2026-104843
- Aliases
- GHSA-2cv4-cqwr-gwf7
- CVSS_V4
- CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Description
### Impact In versions of uv from 0.12.7 to 0.12.18 on Windows, uv could be induced into writing a file outside of the installation prefix during wheel installation. A malicious wheel could use this to place an executable outside of the intended environment, including in a directory already present on the user's PATH. This vulnerability only affects Windows hosts; no other platforms are affected. ### Patches uv 0.12.18 and newer address this vulnerability. Users are encouraged to upgrade to 0.12.18. ### Workarounds There is no workaround other than upgrading to uv 0.12.18.
Affected packages
| Package | Versions |
|---|---|
| PyPI · uv | introduced 0.12.7, fixed 0.12.18 |
References
- https://github.com/astral-sh/uv/security/advisories/GHSA-2cv4-cqwr-gwf7 WEB
- https://nvd.nist.gov/vuln/detail/CVE-2026-104843 ADVISORY
- https://github.com/astral-sh/uv/pull/21923 WEB
- https://github.com/astral-sh/uv/commit/67169645278ce082638d619beefa6d062540843b WEB
- https://github.com/astral-sh/uv PACKAGE
- https://github.com/astral-sh/uv/releases/tag/0.12.18 WEB
- https://pypi.org/project/uv PACKAGE
- https://github.com/advisories/GHSA-2cv4-cqwr-gwf7 ADVISORY
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — PyPA Advisory Database |