GHSA-2cv4-cqwr-gwf7
Suggest an improvement- Source
- https://github.com/advisories/GHSA-2cv4-cqwr-gwf7
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-2cv4-cqwr-gwf7/GHSA-2cv4-cqwr-gwf7.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/GHSA-2cv4-cqwr-gwf7
- Aliases
- Published
- 2026-10-05T23:42:09Z
- Modified
- 2026-10-06T00:00:10Z
- Severity
-
- 5.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator
- Summary
- uv: Path traversal on Windows through wheel extraction
- Details
-
Impact
In versions of uv from 0.12.7 to 0.12.18 on Windows, uv could be induced into writing a file outside of the installation prefix during wheel installation.
A malicious wheel could use this to place an executable outside of the intended environment, including in a directory already present on the user's PATH.
This vulnerability only affects Windows hosts; no other platforms are affected.
Patches
uv 0.12.18 and newer address this vulnerability. Users are encouraged to upgrade to 0.12.18.
Workarounds
There is no workaround other than upgrading to uv 0.12.18.
- Database specific
{ "cwe_ids": [ "CWE-22" ], "github_reviewed": true, "github_reviewed_at": "2026-10-05T23:42:09Z", "nvd_published_at": "2026-10-02T16:16:46Z", "severity": "MODERATE" }- References
-
- https://github.com/astral-sh/uv/security/advisories/GHSA-2cv4-cqwr-gwf7
- https://nvd.nist.gov/vuln/detail/CVE-2026-104843
- https://github.com/astral-sh/uv/pull/21923
- https://github.com/astral-sh/uv/commit/67169645278ce082638d619beefa6d062540843b
- https://github.com/astral-sh/uv
- https://github.com/astral-sh/uv/releases/tag/0.12.18
Affected packages
PyPI / uv
Package
- Name
- uv
- View open source insights on deps.dev
- Purl
- pkg:pypi/uv
crates.io / uv
Package
- Name
- uv
- View open source insights on deps.dev
- Purl
- pkg:cargo/uv