[ Vendor · 4 CVEs ]
astral-sh
CVEs affecting astral-sh published in the last 30 days, plus any astral-sh CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-114110 | 21 Oct 2026 | CVSS 5.3 | astral-sh uvAstral uv before 0.11.6 contains a path traversal vulnerability that allows attackers to delete arbitrary files by supplying wheels with relative… | |
| CVE-2026-114109 | 21 Oct 2026 | CVSS 8.8 | astral-sh uvuv before 0.11.15 contains a path traversal vulnerability that allows malicious wheels to write files outside the scripts directory via crafted… | |
| CVE-2025-71437 | 21 Oct 2026 | CVSS 6.5 | astral-sh uvAstral uv before 0.8.22 contains a path traversal vulnerability in source distribution (sdist) tar extraction that allows a specially crafted… | |
| CVE-2026-104843 | 2 Oct 2026 | CVSS 5.9 | uv: Path traversal on Windows through wheel extractionuv is a Python package and project manager written in Rust. From 0.12.7 until 0.12.18, uv wheel extraction on Windows can process a malicious wheel… | Fix |