https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-10-09T19:29:28.166309+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/fkie_cve-2026-104843 fkie_cve-2026-104843 2026-10-09T19:29:28.197336+00:00

uv is a Python package and project manager written in Rust. From 0.12.7 until 0.12.18, uv wheel extraction on Windows can process a malicious wheel in a way that writes a file outside the installation prefix, including an executable in a directory already present on the user's PATH. Non-Windows hosts are not affected. This issue is fixed in version 0.12.18.

 https://vulnerability.circl.lu/vuln/ghsa-2cv4-cqwr-gwf7 GHSA-2cv4-cqwr-gwf7 — uv: Path traversal on Windows through wheel extraction 2026-10-09T19:29:28.197429+00:00

Affected: PyPI: uv, crates.io: uv

### Impact

In versions of uv from 0.12.7 to 0.12.18 on Windows, uv could be induced into writing a file outside of the installation prefix during wheel installation.

A malicious wheel could use this to place an executable outside of the intended environment, including in a directory already present on the user's PATH.

This vulnerability only affects Windows hosts; no other platforms are affected.

### Patches

uv 0.12.18 and newer address this vulnerability. Users are encouraged to upgrade to 0.12.18.

### Workarounds

There is no workaround other than upgrading to uv 0.12.18.