CVE-2026-114109: falha de alta gravidade em astral-sh uv
uv before 0.11.15 Arbitrary File Write via Entry Point Names
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.7epss 0.4%
uv before 0.11.15 contains a path traversal vulnerability that allows malicious wheels to write files outside the scripts directory via crafted console_scripts or gui_scripts entry point names. Attackers who induce users to install a malicious wheel can place executables in PATH directories, shadowing or overwriting existing binaries for code execution.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Produtos afetados
astral-sh · uvCVEs relacionadas — astral-sh uv
No mesmo produto, das mais perigosas para as menos.
CVE-2026-104843MEDIUMuv: Path traversal on Windows through wheel extractionEPSS 0.4%CVE-2026-114110HIGHAstral uv before 0.11.6 Arbitrary File Deletion via Wheel RECORD EntriesEPSS 0.3%CVE-2025-71437HIGHAstral uv through 0.8.21 Path Traversal via Symlinks in Sdist Tar ExtractionEPSS 0.3%CVE-2025-54368MEDIUMuv is vulnerable to ZIP payload obfuscation through parsing differentialsEPSS 0.2%CVE-2025-13327MEDIUMUv: uv: specially crafted zip archives lead to arbitrary code execution due to parsing differentialsEPSS 0.2%