Threats affecting pkg:cargo/uv

A path traversal vulnerability in astral-sh uv versions before 0.11.15 allows maliciously crafted Python wheel packages to write files outside the intended scripts directory. This can enable attackers to place executables in system PATH directories, potentially overwriting or shadowing existing binaries and leading to code execution. The vulnerability is fixed in version 0.11.15.

A vulnerability in the uv package allows code execution during package resolution or installation via specially crafted ZIP archives exploiting parsing differentials. This requires user interaction to install a malicious package. The flaw affects versions prior to 0.9.6 and has been fixed in version 0.9.6.