[ CVE-2026-114110 · Published 21 Oct 2026 ]
Vulnerability in astral-sh uv
CVSS 5.3
EPSS <1%No fix listed yet
[ Description ]Official description
Astral uv before 0.11.6 contains a path traversal vulnerability that allows attackers to delete arbitrary files by supplying wheels with relative traversal paths in RECORD entries. Attackers can craft a malicious wheel whose RECORD references files outside the installation prefix, causing uv to delete those files when the user uninstalls the package.
[ Fixes ]Fixes and patches
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.