A vulnerability in the uv package allows code execution during package resolution or installation via specially crafted ZIP archives exploiting parsing differentials. This requires user interaction to install a malicious package. The flaw affects versions prior to 0.9.6 and has been fixed in version 0.9.6.