CVE-2025-13327mediumCWE-1286

CVE-2025-13327: falha de média gravidade em astral-sh uv

Uv: uv: specially crafted zip archives lead to arbitrary code execution due to parsing differentials

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Red Hat OpenShift AI+ Monitorar Red Hat AI Inference Server

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 6.3epss 0.2%
A flaw was found in uv. This vulnerability allows an attacker to execute malicious code during package resolution or installation via specially crafted ZIP (Zipped Information Package) archives that exploit parsing differentials, requiring user interaction to install an attacker-controlled package.
CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H
Produtos afetados
astral-sh · uvRed Hat · Red Hat AI Inference ServerRed Hat · Red Hat OpenShift AI 3.0Red Hat · Red Hat OpenShift AI (RHOAI)
CVEs relacionadas — astral-sh uv

No mesmo produto, das mais perigosas para as menos.

CVE-2023-52355HIGHLibtiff: tiffrasterscanlinesize64 produce too-big size and could cause oomEPSS 1.8%CVE-2026-56211HIGHLibaom: libaom: remote code execution via svc layer context handling with attacker-controlled framesEPSS 0.9%CVE-2026-58015MEDIUMGlib: path traversal in glib/gio/gdbusauthmechanismsha1.c via keyring_lookup_entry and mechanism_client_data_receiveEPSS 0.8%CVE-2026-14164HIGHLibarchive: double-free vulnerability in rar5 decompression logic via dangling filtered_buf pointer in init_unpack()EPSS 0.8%CVE-2026-74860HIGHLibxml2: double-free/uaf in libxml2 python bindingsEPSS 0.7%CVE-2026-56209HIGHLibaom: libaom: arbitrary address write via svc layer context oob and cyclic refresh map pointer hijackEPSS 0.6%