CVE-2026-104843
MediumCVSS 5.9Exploitation Probability (EPSS)
Low risk35th percentile - higher than 35% of all known CVEs
Summary
uv (Python package and project manager) from version 0.12.7 to 0.12.18 has a vulnerability on Windows that allows writing a file outside the installation prefix during extraction of a malicious wheel. This can place an executable in a directory on the user's PATH.
Risk Assessment
An attacker can supply a malicious wheel package that, when installed on Windows, writes an executable to a PATH directory, potentially leading to code execution.
Recommendation
Update uv to version 0.12.18 or later.
Other vulnerabilities in uv
See all- CVE-2026-114110Medium
Astral uv before 0.11.6 contains a path traversal vulnerability that allows attackers to delete arbitrary files by supplying wheels with relative traversal paths in RECORD entries. A malicious wheel can reference files outside the installation prefix.
- CVE-2026-114109High
uv before 0.11.15 contains a path traversal vulnerability that allows malicious wheels to write files outside the scripts directory via crafted console_scripts or gui_scripts entry point names. Attackers who induce users to install a malicious wheel can place executables in PATH directories, shadowing or overwriting existing binaries for code execution.
- CVE-2025-13327Medium
A flaw was found in uv. This vulnerability allows an attacker to execute malicious code during package resolution or installation via specially crafted ZIP archives that exploit parsing differentials, requiring user interaction to install an attacker-controlled package.
Original NVD description (English source)
uv is a Python package and project manager written in Rust. From 0.12.7 until 0.12.18, uv wheel extraction on Windows can process a malicious wheel in a way that writes a file outside the installation prefix, including an executable in a directory already present on the user's PATH. Non-Windows hosts are not affected. This issue is fixed in version 0.12.18.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS