Security advisories

critical2026-10-20

uv's bundled CA store trusts an emSign root whose intermediate CA keys are compromised

GHSA-hq85-5cpj-mr62

medium2026-10-05

uv: Path traversal on Windows through wheel extraction

GHSA-2cv4-cqwr-gwf7 · CVE-2026-104843

medium2026-05-29

uv is vulnerable to arbitrary file write through entry point names

GHSA-4gg8-gxpx-9rph

low2026-04-10

uv vulnerable to arbitrary file deletion through RECORD entries

GHSA-pjjw-68hj-v9mw · CVE-2026-114110

medium2026-02-27

uv has ZIP payload obfuscation through parsing differentials

GHSA-v653-r55g-hcmg · CVE-2025-13327

medium2025-10-29

uv allows ZIP payload obfuscation through parsing differentials

GHSA-pqhf-p39g-3x64

low2025-10-21

uv has differential in tar extraction with PAX headers

GHSA-w476-p2h3-79g9

medium2025-08-07

uv allows ZIP payload obfuscation through parsing differentials

GHSA-8qf3-x8v5-2pj8 · CVE-2025-54368