astral-sh uv
6 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-114110 | < 0.11.6 | Astral uv before 0.11.6 Arbitrary File Deletion via Wheel RECORD Entries | HIGH 8.7 | 0.3 % | ||
| CVE-2026-114109 | < 0.11.15 | uv before 0.11.15 Arbitrary File Write via Entry Point Names | HIGH 8.7 | 0.4 % | ||
| CVE-2025-71437 | ≤ 0.8.21 | Astral uv through 0.8.21 Path Traversal via Symlinks in Sdist Tar Extraction | HIGH 8.7 | 0.3 % | ||
| CVE-2026-104843 | >= 0.12.7, < 0.12.18 | uv: Path traversal on Windows through wheel extraction | MEDIUM 5.9 | 0.4 % | ||
| CVE-2025-13327 | < 0.9.6 | Uv: uv: specially crafted zip archives lead to arbitrary code execution due to parsing differentials | MEDIUM 6.3 | 0.2 % | ||
| CVE-2025-54368 | < 0.8.6 | uv is vulnerable to ZIP payload obfuscation through parsing differentials | MEDIUM 6.8 | 0.2 % |