{
 "version": "https://jsonfeed.org/version/1.1",
 "title": "astral-sh uv: important CVE events",
 "home_page_url": "https://patchwire.jonathanross.dev/products/astral-sh--uv/",
 "feed_url": "https://patchwire.jonathanross.dev/feeds/products/astral-sh--uv/important.json",
 "authors": [
  {
   "name": "Patchwire"
  }
 ],
 "language": "en",
 "items": [
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-114109/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-114109/",
   "title": "CVE-2026-114109 · astral-sh uv · disclosed",
   "content_text": "uv before 0.11.15 contains a path traversal vulnerability that allows malicious wheels to write files outside the scripts directory via crafted console_scripts or gui_scripts entry point names. Attackers who induce users to install a malicious wheel can place executables in PATH directories, shadowing or overwriting existing binaries for code execution.",
   "date_published": "2026-10-21T00:37:08Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-114109/fixed/crates.io",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-114109/",
   "title": "CVE-2026-114109 · astral-sh uv · fixed upstream (crates.io)",
   "content_text": "Fixed versions: uv 0.11.15.",
   "date_published": "2026-10-21T00:37:08Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-114109/fixed/pypi",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-114109/",
   "title": "CVE-2026-114109 · astral-sh uv · fixed upstream (PyPI)",
   "content_text": "Fixed versions: uv 0.11.15.",
   "date_published": "2026-10-21T00:37:08Z"
  }
 ]
}