Astral uv CVE-2025-71437

Exploitation requires the victim to install a specially crafted source distribution (sdist) using a vulnerable uv version (before 0.8.22) where the install path goes through uv's sdist tar-extraction code; the malicious archive must contain a crafted symlink sequence that resolves outside the intended extraction prefix. Limiting factors: the attacker does not run code on the target directly - a user must actively choose to install the attacker-controlled package (so curated, pinned, or hash-verified dependency sources materially reduce exposure), and only uv (not other installers) is affected. Installing only trusted/first-party packages, or upgrading to uv 0.8.22+, removes the condition.

This is a supply-chain path-traversal flaw (CWE-22) in Astral uv's sdist tar extraction, scored CVSS 4.0 8.7 (High) by the reporter. The provided vector (AV:N/AC:L/PR:N/UI:N/VC:H/VI:N/VA:N) conflicts with the description: the described impact is writing arbitrary files OUTSIDE the extraction prefix, which is an INTEGRITY impact, yet the vector records confidentiality-high (VC:H) and integrity-none (VI:N) - these appear transposed and should be treated with caution. The vector also lists UI:N, but exploitation realistically requires a victim to install the attacker's malicious sdist, i.e. user action is needed - so the 'unauthenticated, no-interaction' reading overstates ease. No EPSS score, no CISA KEV listing, and no public POC are present in the input, so there is no evidence of active exploitation; exploitation status is 'no public exploit identified at time of analysis.' Net: this is a genuine, high-impact issue (arbitrary file write via a crafted package can lead to code execution), but it is a social/supply-chain vector requiring the victim to install a malicious package rather than a directly remote-triggerable server bug - real priority for anyone installing untrusted sdists, lower urgency where package sources are curated/pinned.

An attacker publishes a malicious Python source distribution (sdist) to a package index (or supplies it via a dependency) containing a crafted sequence of symlinks in its tar archive. When a victim installs the package with a vulnerable uv (before 0.8.22), the symlink chain redirects extraction writes outside the intended install prefix, dropping attacker-controlled files into arbitrary filesystem locations (e.g. shell profiles or startup scripts), which can lead to code execution. No public exploit code is identified in the provided data; disclosure is via a VulnCheck advisory and a GitHub Security Advisory (GHSA-7j9j-68r2-f35q).