~ / search / GHSA-2cv4-cqwr-gwf7

GHSA-2cv4-cqwr-gwf7

uv: Path traversal on Windows through wheel extraction

Source: GitHub Advisory Database (reviewed) Moderate CVE-2026-104843

Packages

EcosystemPackageAffectedFixed in
PyPI uv >= 0.12.7, < 0.12.18 0.12.18
crates.io uv >= 0.12.7, < 0.12.18 0.12.18

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact In versions of uv from 0.12.7 to 0.12.18 on Windows, uv could be induced into writing a file outside of the installation prefix during wheel installation. A malicious wheel could use this to place an executable outside of the intended environment, including in a directory already present on the user's PATH. This vulnerability only affects Windows hosts; no other platforms are affected. ### Patches uv 0.12.18 and newer address this vulnerability. Users are encouraged to upgrade to 0.12.18. ### Workarounds There is no workaround other than upgrading to uv 0.12.18.

References

External links from the advisory. They lead to third-party sites.