{
 "version": "https://jsonfeed.org/version/1.1",
 "title": "astral-sh uv: all CVE events",
 "home_page_url": "https://patchwire.jonathanross.dev/products/astral-sh--uv/",
 "feed_url": "https://patchwire.jonathanross.dev/feeds/products/astral-sh--uv/all.json",
 "authors": [
  {
   "name": "Patchwire"
  }
 ],
 "language": "en",
 "items": [
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-114110/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-114110/",
   "title": "CVE-2026-114110 · astral-sh uv · disclosed",
   "content_text": "Astral uv before 0.11.6 contains a path traversal vulnerability that allows attackers to delete arbitrary files by supplying wheels with relative traversal paths in RECORD entries. Attackers can craft a malicious wheel whose RECORD references files outside the installation prefix, causing uv to delete those files when the user uninstalls the package.",
   "date_published": "2026-10-21T00:37:09Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-114110/fixed/chainguard",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-114110/",
   "title": "CVE-2026-114110 · astral-sh uv · fixed in Chainguard (airflow-2 2.11.2-r8)",
   "content_text": "Fixed versions: airflow-2 2.11.2-r8.",
   "date_published": "2026-10-21T00:37:09Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-114110/fixed/pypi",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-114110/",
   "title": "CVE-2026-114110 · astral-sh uv · fixed upstream (PyPI)",
   "content_text": "Fixed versions: uv 0.11.6.",
   "date_published": "2026-10-21T00:37:09Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-114109/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-114109/",
   "title": "CVE-2026-114109 · astral-sh uv · disclosed",
   "content_text": "uv before 0.11.15 contains a path traversal vulnerability that allows malicious wheels to write files outside the scripts directory via crafted console_scripts or gui_scripts entry point names. Attackers who induce users to install a malicious wheel can place executables in PATH directories, shadowing or overwriting existing binaries for code execution.",
   "date_published": "2026-10-21T00:37:08Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-114109/fixed/crates.io",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-114109/",
   "title": "CVE-2026-114109 · astral-sh uv · fixed upstream (crates.io)",
   "content_text": "Fixed versions: uv 0.11.15.",
   "date_published": "2026-10-21T00:37:08Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-114109/fixed/pypi",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-114109/",
   "title": "CVE-2026-114109 · astral-sh uv · fixed upstream (PyPI)",
   "content_text": "Fixed versions: uv 0.11.15.",
   "date_published": "2026-10-21T00:37:08Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2025-71437/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2025-71437/",
   "title": "CVE-2025-71437 · astral-sh uv · disclosed",
   "content_text": "Astral uv before 0.8.22 contains a path traversal vulnerability in source distribution (sdist) tar extraction that allows a specially crafted sequence of symlinks to redirect file writes outside the intended extraction prefix. Attackers can publish a malicious sdist that, when installed by a victim, writes arbitrary files to filesystem locations outside the installation prefix.",
   "date_published": "2026-10-21T00:36:20Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-104843/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-104843/",
   "title": "CVE-2026-104843 · astral-sh uv · disclosed",
   "content_text": "uv is a Python package and project manager written in Rust. From 0.12.7 until 0.12.18, uv wheel extraction on Windows can process a malicious wheel in a way that writes a file outside the installation prefix, including an executable in a directory already present on the user's PATH. Non-Windows hosts are not affected. This issue is fixed in version 0.12.18.",
   "date_published": "2026-10-02T15:29:15Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-104843/fixed/crates.io",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-104843/",
   "title": "CVE-2026-104843 · astral-sh uv · fixed upstream (crates.io)",
   "content_text": "Fixed versions: uv 0.12.18.",
   "date_published": "2026-10-02T15:29:15Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-104843/fixed/pypi",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-104843/",
   "title": "CVE-2026-104843 · astral-sh uv · fixed upstream (PyPI)",
   "content_text": "Fixed versions: uv 0.12.18.",
   "date_published": "2026-10-02T15:29:15Z"
  }
 ]
}