CVE-2026-114110
MediumCVSS 5.3Summary
Astral uv before 0.11.6 contains a path traversal vulnerability that allows attackers to delete arbitrary files by supplying wheels with relative traversal paths in RECORD entries. A malicious wheel can reference files outside the installation prefix.
Risk Assessment
An attacker can cause deletion of files outside the installation directory when the user uninstalls the package, potentially leading to data loss or system instability.
Recommendation
Update uv to version 0.11.6 or later. Avoid installing untrusted wheels.
Other vulnerabilities in uv
See all- CVE-2026-114109High
uv before 0.11.15 contains a path traversal vulnerability that allows malicious wheels to write files outside the scripts directory via crafted console_scripts or gui_scripts entry point names. Attackers who induce users to install a malicious wheel can place executables in PATH directories, shadowing or overwriting existing binaries for code execution.
- CVE-2026-104843Medium
uv (Python package and project manager) from version 0.12.7 to 0.12.18 has a vulnerability on Windows that allows writing a file outside the installation prefix during extraction of a malicious wheel. This can place an executable in a directory on the user's PATH.
Original NVD description (English source)
Astral uv before 0.11.6 contains a path traversal vulnerability that allows attackers to delete arbitrary files by supplying wheels with relative traversal paths in RECORD entries. Attackers can craft a malicious wheel whose RECORD references files outside the installation prefix, causing uv to delete those files when the user uninstalls the package.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS