uv CVE-2026-104843

Exploitation requires a Windows host running a vulnerable uv (0.12.7 through 0.12.17) and the victim actively installing an attacker-crafted wheel (UI:A). The wheel must contain an archive member whose path, after rebuilding, resolves to a Windows path prefix or root (e.g. 'C:module.py', '\\server\share\module.py', or 'package/../C:module.py'), allowing the write to escape the installation prefix; for code-execution impact the written file must land in a directory already on the user's PATH. Limiting factors: non-Windows hosts are not affected, no exploitation occurs without the user installing the untrusted wheel, and the issue is fully remediated in 0.12.18.

This is a medium-severity, conditional-impact issue rather than an emergency. The vendor CVSS 4.0 vector (5.9) shows network-reachable delivery (AV:N) with low complexity (AC:L) and no privileges (PR:N), but it is gated by an attack requirement (AT:P) and active user interaction (UI:A) and yields only integrity impact (VI:H; VC:N/VA:N). In practice this means an attacker cannot exploit a running system remotely - a Windows user must be convinced to install a maliciously crafted wheel with a vulnerable uv version (0.12.7-0.12.17). No EPSS score was provided, there is no CISA KEV listing, and no public exploit was identified at time of analysis; the only public artifacts are the fix PR/commit and the security advisory, which include regression tests but not a weaponized exploit. The realistic threat model is supply-chain / typosquatting: planting an executable in a PATH directory for later code execution. Signals are consistent (no conflict between CVSS and description), so this warrants prompt patching of Windows developer/CI environments but does not indicate widespread active exploitation.

An attacker publishes a malicious wheel (e.g. via typosquatting or a compromised index) whose archive member path rebuilds into a Windows prefix such as 'C:module.py'. A Windows user installs it with a vulnerable uv, and extraction writes a file outside the installation prefix - including an executable into a directory already on PATH - so the attacker's binary runs the next time that command name is invoked. No public exploit was identified at time of analysis, though the fix PR demonstrates the vulnerable path-handling cases.