Vulnerabilities in astral-sh
9 resultsCVE-2025-62518HIGHastral-tokio-tar Vulnerable to PAX Header DesynchronizationEPSS 0.7%CVE-2026-104843MEDIUMuv: Path traversal on Windows through wheel extractionEPSS 0.4%CVE-2026-114109HIGHuv before 0.11.15 Arbitrary File Write via Entry Point NamesEPSS 0.4%CVE-2026-114110HIGHAstral uv before 0.11.6 Arbitrary File Deletion via Wheel RECORD EntriesEPSS 0.3%CVE-2025-71437HIGHAstral uv through 0.8.21 Path Traversal via Symlinks in Sdist Tar ExtractionEPSS 0.3%CVE-2026-32766LOWastral-tokio-tar insufficiently validates PAX extensions during extractionEPSS 0.3%CVE-2025-54368MEDIUMuv is vulnerable to ZIP payload obfuscation through parsing differentialsEPSS 0.2%CVE-2025-59825MEDIUMastral-tokio-tar has a path traversal in tar extractionEPSS 0.2%CVE-2025-13327MEDIUMUv: uv: specially crafted zip archives lead to arbitrary code execution due to parsing differentialsEPSS 0.2%