.nav-burger { display: none !important; } @media (max-width: 1180px) { /* Match Tailwind's base layer: its important [hidden] reset otherwise wins. */ @layer base { .nav-overlay[hidden] { display: flex !important; } } .nav-overlay[hidden] { position: static; padding: 2rem 1rem; } }

uv 0.8.6 vulnerabilities

7 advisories known · uv@0.8.6 · 5 affect this release · Dependencies not checked

SEVERITYADVISORYPUBLISHED

Affects 0.8.6

SEVERITYADVISORYPUBLISHED

Criticaluv's bundled CA store trusts an emSign root whose intermediate CA keys are compromisedGHSA-hq85-5cpj-mr62PYSEC-2026-4321Affected <0.13.4Fixed in 0.13.4OSV source ↗21 days ago

Mediumuv is vulnerable to arbitrary file write through entry point namesGHSA-4gg8-gxpx-9rphCVE-2026-114109Affected <0.11.15Fixed in 0.11.15OSV source ↗5 months ago

Mediumuv allows ZIP payload obfuscation through parsing differentialsGHSA-pqhf-p39g-3x64CVE-2025-13327GHSA-v653-r55g-hcmgPYSEC-2026-2295Affected <0.9.6Fixed in 0.9.6OSV source ↗9 months ago

Lowuv vulnerable to arbitrary file deletion through RECORD entriesGHSA-pjjw-68hj-v9mwCVE-2026-114110Affected <0.11.6Fixed in 0.11.6OSV source ↗7 months ago

Lowuv has differential in tar extraction with PAX headersGHSA-w476-p2h3-79g9Affected <0.9.5Fixed in 0.9.5OSV source ↗last year

Does not affect 0.8.6

SEVERITYADVISORYPUBLISHED

Mediumuv: Path traversal on Windows through wheel extractionGHSA-2cv4-cqwr-gwf7CVE-2026-104843PYSEC-2026-4305Affected >=0.12.7 <0.12.18Fixed in 0.12.18OSV source ↗last month

Mediumuv allows ZIP payload obfuscation through parsing differentialsGHSA-8qf3-x8v5-2pj8CVE-2025-54368PYSEC-2026-2001Affected <0.8.6Fixed in 0.8.6OSV source ↗4 months ago