CVE-2026-114109: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in astral-sh uv

The vulnerability in astral-sh uv prior to version 0.11.15 involves improper limitation of a pathname to a restricted directory, specifically a path traversal issue. Maliciously crafted Python wheel packages can exploit this by using specially named console_scripts or gui_scripts entry points to write files outside the designated scripts directory. This enables attackers who trick users into installing such malicious wheels to place executables in directories included in the system PATH, potentially leading to arbitrary code execution by overwriting or shadowing existing binaries.

Successful exploitation allows an attacker to place executable files in system PATH directories, which can result in arbitrary code execution without requiring user privileges or interaction beyond installing a malicious wheel. This can compromise system integrity and security by enabling execution of attacker-controlled code in place of legitimate binaries.

No explicit patch or remediation details are provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid installing untrusted or unaudited Python wheel packages, especially those with console_scripts or gui_scripts entry points.