CVE-2025-71437: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in astral-sh uv

Astral uv before version 0.8.22 contains a path traversal vulnerability in its source distribution tar extraction process. The flaw allows a crafted sequence of symbolic links to redirect file writes outside the intended extraction prefix. This means an attacker can create a malicious source distribution package that, upon installation by a victim, writes arbitrary files to locations outside the installation directory, potentially leading to unauthorized file modification or system compromise.

An attacker can cause arbitrary files to be written outside the intended extraction directory during installation of a malicious source distribution package. This could lead to unauthorized file modification or system compromise. The vulnerability does not require privileges, user interaction, or authentication, and has a high CVSS 4.0 score of 8.7, indicating significant impact if exploited.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid installing source distributions from untrusted sources or use extraction tools that properly validate symlinks and path traversal attempts.