Threat Intelligence Database

A path traversal vulnerability exists in astral-sh uv versions before 0.11.15. This flaw allows malicious Python wheel packages to write files outside the intended scripts directory by crafting console_scripts or gui_scripts entry point names. Exploitation can lead to placing executables in system PATH directories, potentially overwriting or shadowing binaries and enabling code execution.

The uv software versions before 0.13.4 include a bundled CA root certificate 'emSign ECC Root CA - G3' whose intermediate CA keys have been compromised. This allows an attacker with access to these keys to issue fraudulent certificates trusted by uv, enabling potential man-in-the-middle (MITM) attacks. Version 0.13.4 removes this root from the trusted bundle, mitigating the risk.

uv is a Python package and project manager written in Rust. From 0.12.7 until 0.12.18, uv wheel extraction on Windows can process a malicious wheel in a way that writes a file outside the installation prefix, including an executable in a directory already present on the user's PATH. Non-Windows hosts are not affected. This issue is fixed in version 0.12.18.