Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
3 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Impact In versions of uv from 0.12.7 to 0.12.18 on Windows, uv could be induced into writing a file outside of the installation prefix during wheel installation. A malicious wheel could use this to place an executable outside of the intended environment, including in a directory already present on the user's PATH. This vulnerability only affects Windows hosts; no other platforms are affected. Patches uv 0.12.18 and newer address this vulnerability. Users are encouraged to upgrade to 0.12.18. Workarounds There is no workaround other than upgrading to uv 0.12.18.
Recommended action: Upgrade to 0.12.18 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact In versions of uv prior to 0.11.15, when installing a distribution containing an entry point specification (under consolescripts or guiscripts), uv would place the generated entry point according to the given name even if doing so resulted in a path outside of the environment's scripts directory. A malicious wheel could use this to place an executable outside of the intended environment, including in a directory already present on the user's PATH. This could shadow or overwrite an existing executable and potentially result in unexpected code execution under the wheel's control, even if the wheel's installation environment was not explicitly added to PATH by the user. In order to exploit this vulnerability, the attacker must induce their target into installing a malicious wheel. Patches uv 0.11.15 and newer address this vulnerability. Users are encouraged to upgrade to 0.11.15. Workarounds There is no workaround other than upgrading to uv 0.11.15.
Recommended action: Upgrade to 0.11.15 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact In versions 0.9.5 and earlier of uv, ZIP archives were handled in a manner that enabled two parsing differentials against other components of the Python packaging ecosystem: 1. Central directory entries in a ZIP archive can contain comment fields. However, uv would assume that these fields were not present, since they aren't widely used. Consequently, a ZIP archive could be constructed where uv would interpret the contents of a central directory comment field as ZIP control structures (such as a new central directory entry), rather than skipping over them. 2. Both local file entries and central directory entries contain filename fields, which are used to place archive members on disk. These fields are arbitrary sequences of bytes, and may therefore be invalid or ambiguous. For example, they may contain ASCII null bytes, in which case different ZIP extractors behave differently: Python's zipfile module truncates the filename at the first null, while uv would skip (not extract)…
Recommended action: Upgrade to 0.9.6 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.