PT-2025-32302 · Uv · Uv

Calebbrown · Published 2025-08-07 · Updated 2025-10-11 · CVE-2025-54368

Positive Technologies (AI Summary)

CVSS v4.0

6.8

Medium

Base vector

AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions uv versions 0.8.5 and earlier

Description uv is a Python package and project manager written in Rust. Versions 0.8.5 and earlier handled remote ZIP archives in a streamwise fashion without reconciling file entries against the archive’s central directory. This allowed an attacker to create a ZIP archive that would extract with legitimate contents on some package installers and malicious contents on others, or a "stacked" ZIP input with multiple internal ZIPs, which would be handled differently by different package installers. This could be used to target specific installers.

Recommendations uv versions prior to 0.8.6 should be upgraded. As a workaround, set the environment variable UV INSECURE NO ZIP VALIDATION to 1 to revert to the previous behavior.

Exploit

Fix

RCE

Weakness Enumeration

CWE-436

CWE-20

Related Identifiers

CVE-2025-54368

ECHO-AB98-58E8-47AA

GHSA-8QF3-X8V5-2PJ8

OESA-2025-2098

OPENSUSE-SU-2025:15429-1

Affected Products

Uv

References · 21

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/54xxx/CVE-2025-54368.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-55159 · Security Note
• https://osv.dev/vulnerability/GHSA-8qf3-x8v5-2pj8 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-54368 · Security Note
• https://osv.dev/vulnerability/CVE-2025-54368 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2025-2098 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15429-1 · Vendor Advisory
• https://github.com/astral-sh/uv · Note
• https://github.com/astral-sh/uv/security/advisories/GHSA-8qf3-x8v5-2pj8 · Note
• https://github.com/astral-sh/uv/commit/7f1eaf48c193e045ca2c62c4581048765c55505f · Note
• https://blog.pypi.org/posts/2025-08-07-wheel-archive-confusion-attacks · Note
• https://suse.com/security/cve/CVE-2025-54368 · Note
• https://t.me/CVEtracker/29480 · Telegram Post
• https://twitter.com/Cezar_H_Linux/status/1958590880299851840 · Twitter Post
• https://twitter.com/CVEnew/status/1953626476470767693 · Twitter Post