PT-2026-47548 · Pypi · Uv
Publicado
2026-05-29
·
Atualizado
2026-05-29
Nenhuma
Não há classificações de severidade ou métricas disponíveis. Quando houver, atualizaremos as informações correspondentes na página.
Impact
In versions of uv prior to 0.11.15, when installing a distribution containing an entry point specification (under
console scripts or gui scripts), uv would place the generated entry point according to the given name even if doing so resulted in a path outside of the environment's scripts directory.A malicious wheel could use this to place an executable outside of the intended environment, including in a directory already present on the user's
PATH. This could shadow or overwrite an existing executable and potentially result in unexpected code execution under the wheel's control, even if the wheel's installation environment was not explicitly added to PATH by the user.In order to exploit this vulnerability, the attacker must induce their target into installing a malicious wheel.
Patches
uv 0.11.15 and newer address this vulnerability. Users are encouraged to upgrade to 0.11.15.
Workarounds
There is no workaround other than upgrading to uv 0.11.15.
Path traversal
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Uv