CVE-2025-13327mediumCWE-1286

CVE-2025-13327: fallo de gravedad media en astral-sh uv

Uv: uv: specially crafted zip archives lead to arbitrary code execution due to parsing differentials

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear Red Hat OpenShift AI+ Monitorear Red Hat AI Inference Server

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 6.3epss 0.2%
A flaw was found in uv. This vulnerability allows an attacker to execute malicious code during package resolution or installation via specially crafted ZIP (Zipped Information Package) archives that exploit parsing differentials, requiring user interaction to install an attacker-controlled package.
CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H
Productos afectados
astral-sh · uvRed Hat · Red Hat AI Inference ServerRed Hat · Red Hat OpenShift AI 3.0Red Hat · Red Hat OpenShift AI (RHOAI)
CVEs relacionadas — astral-sh uv

En el mismo producto, de las más peligrosas a las menos.

CVE-2023-52355HIGHLibtiff: tiffrasterscanlinesize64 produce too-big size and could cause oomEPSS 1.8%CVE-2026-56211HIGHLibaom: libaom: remote code execution via svc layer context handling with attacker-controlled framesEPSS 0.9%CVE-2026-58015MEDIUMGlib: path traversal in glib/gio/gdbusauthmechanismsha1.c via keyring_lookup_entry and mechanism_client_data_receiveEPSS 0.8%CVE-2026-14164HIGHLibarchive: double-free vulnerability in rar5 decompression logic via dangling filtered_buf pointer in init_unpack()EPSS 0.8%CVE-2026-74860HIGHLibxml2: double-free/uaf in libxml2 python bindingsEPSS 0.7%CVE-2026-56209HIGHLibaom: libaom: arbitrary address write via svc layer context oob and cyclic refresh map pointer hijackEPSS 0.6%