Vulnerabilities for uv

First version without a known vulnerability: 0.11.15

Details

• GHSA-4gg8-gxpx-9rph2026-05-29

  uv is vulnerable to arbitrary file write through entry point names

  Fixed in: 0.11.15

• GHSA-pjjw-68hj-v9mw2026-04-10

  uv vulnerable to arbitrary file deletion through RECORD entries

  Fixed in: 0.11.6

• GHSA-pqhf-p39g-3x642025-10-29

  uv allows ZIP payload obfuscation through parsing differentials

  Fixed in: 0.9.6

• GHSA-w476-p2h3-79g92025-10-21

  uv has differential in tar extraction with PAX headers

  Fixed in: 0.9.5

• GHSA-8qf3-x8v5-2pj82025-08-07

  uv allows ZIP payload obfuscation through parsing differentials

  Fixed in: 0.8.6