Astral uv Path Traversal in Package Extraction

Arbitrary file write in Astral uv before 0.11.15 allows a malicious wheel to place generated console_scripts or gui_scripts entry points outside the environment's scripts directory, potentially shadowing or overwriting executables in a PATH directory for code execution. The flaw affects uv versions prior to 0.11.15 across the pip/uv and rust/uv packages and is a conditional risk: the attacker must first persuade the victim to install a crafted wheel, and the assessed vector is local with user interaction and changed scope. No public exploit code and no confirmed active exploitation were identified at time of analysis; vendor-released patch: uv 0.11.15.

Installing a malicious source distribution with Astral uv versions before 0.8.22 can let a crafted chain of symlinks redirect file writes outside the intended extraction prefix, producing arbitrary file writes on the installer’s filesystem with high integrity impact but no confidentiality or availability impact. The reporter scored this CVSS 4.0 8.7 High, while independent analysis assesses CVSS 3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N and stresses that a user must actively install the attacker-controlled package; no public exploit was identified at time of analysis. Upgrading to uv 0.8.22 or later removes the vulnerable extraction behavior.

Arbitrary file deletion in Astral uv 0.11.5 and earlier allows a maliciously hand-crafted wheel to cause uv to remove files outside the package's installation prefix when that wheel is uninstalled. The attacker must embed relative traversal sequences ('../') in the wheel's RECORD entries - something no standards-compliant Python packaging tool produces - and the victim must both install and later uninstall the package for the deletion to occur; the attacker must also correctly guess the installation prefix depth to reach specific system files. The published CVSS 4.0 score of 8.7 (AV:N/AC:L/PR:N/UI:N) overstates practical exploitability, and our reassessment (CVSS 3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:H/A:H) reflects the required user interaction and prefix-guessing precondition; no public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis. Fixed in uv 0.11.6.