Vulnerability advisory

CVE-2026-104843

uv: Path traversal on Windows through wheel extraction

Published Oct 2, 2026Updated Oct 28, 2026OSV record ↗

Also known as GHSA-2cv4-cqwr-gwf7PYSEC-2026-4305

Severity

CVSS 4.0CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Affected versions

Repository

Affected commits	Fixed by commit
GIT github.com/astral-sh/uv ↗
61291a8ca5477a9ca653f14d2ac5665587c263fa to before 01cb90c1a4f88af09906cb60de9766d2add4a062	`01cb90c1a4f88af09906cb60de9766d2add4a062`
Not specified	`67169645278ce082638d619beefa6d062540843b`
Also listed as affected (11) `0.12.17` `0.12.16` `0.12.15` `0.12.14` `0.12.13` `0.12.12` `0.12.11` `0.12.10` `0.12.9` `0.12.8` `0.12.7`

Description

uv is a Python package and project manager written in Rust. From 0.12.7 until 0.12.18, uv wheel extraction on Windows can process a malicious wheel in a way that writes a file outside the installation prefix, including an executable in a directory already present on the user's PATH. Non-Windows hosts are not affected. This issue is fixed in version 0.12.18.

CVE-2026-104843

Affected versions

Repository

Description

References