Astral uv EUVD-2026-106913

Exploitation requires a maliciously hand-crafted wheel whose RECORD file contains relative traversal ('../') entries pointing outside the installation prefix - standards-compliant Python packaging tooling never produces such RECORDs, so the attacker must manually manipulate the file. The victim must BOTH install AND subsequently uninstall the malformed wheel using uv <= 0.11.5, since uv only consults RECORD for deletion on uninstall. To hit meaningful targets such as system files, the attacker must correctly guess the depth of the installation prefix path. Limiting factors: only files (not directories) can be deleted, absolute paths in RECORD are neutralized (treated as rooted in the install prefix), there is no confidentiality/information-disclosure impact, and the required install-then-uninstall cycle constitutes genuine user interaction despite UI:N in the published vector. Fixed in uv 0.11.6.

The published CVSS 4.0 base score of 8.7 with vector AV:N/AC:L/PR:N/UI:N reads as a trivially exploitable remote, unauthenticated flaw, but the advisory text contradicts this: successful exploitation requires a victim to both install AND subsequently uninstall a hand-crafted malicious wheel, and the attacker must correctly guess the depth of the installation prefix path to reach specific system files. These are meaningful limiting factors that the AC:L/UI:N metrics do not capture. There is also an impact-labeling conflict - the official vector sets VC:H (confidentiality high) with VI:N/VA:N, yet the vulnerability only enables arbitrary file DELETION, which is an integrity/availability impact rather than a confidentiality one; verify impact mapping with the vendor/NVD. No EPSS score, no CISA KEV listing, and no public exploit code are present in the provided data, so there is no signal of active or probable exploitation. Net assessment: this is a legitimate supply-chain/local-tooling risk for developer and CI environments that install untrusted wheels, but the real-world priority is materially lower than the 8.7 implies because of the install-and-uninstall precondition, the path-depth guessing requirement, the file-only (not directory) deletion limit, and the absence of exploitation evidence.

An attacker publishes or supplies a crafted wheel whose RECORD contains relative '../' traversal entries pointing outside the installation prefix. A developer or CI pipeline installs the package with uv (<= 0.11.5) and later uninstalls it, at which point uv honors the malicious RECORD and deletes the referenced files outside the environment. No public PoC is identified in the provided data, and success additionally requires the attacker to guess the installation prefix depth to target specific system files.