PT-2026-120236 · Astral Sh · Uv
CVSS v3.1
5.3
Medium
| Vector | AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N |
Astral uv before 0.11.6 contains a path traversal vulnerability that allows attackers to delete arbitrary files by supplying wheels with relative traversal paths in RECORD entries. Attackers can craft a malicious wheel whose RECORD references files outside the installation prefix, causing uv to delete those files when the user uninstalls the package.
Fix
Relative Path Traversal
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Uv