PT-2026-47548 · Pypi · Uv
Published
2026-05-29
·
Updated
2026-05-29
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
Impact
In versions of uv prior to 0.11.15, when installing a distribution containing an entry point specification (under
console scripts or gui scripts), uv would place the generated entry point according to the given name even if doing so resulted in a path outside of the environment's scripts directory.A malicious wheel could use this to place an executable outside of the intended environment, including in a directory already present on the user's
PATH. This could shadow or overwrite an existing executable and potentially result in unexpected code execution under the wheel's control, even if the wheel's installation environment was not explicitly added to PATH by the user.In order to exploit this vulnerability, the attacker must induce their target into installing a malicious wheel.
Patches
uv 0.11.15 and newer address this vulnerability. Users are encouraged to upgrade to 0.11.15.
Workarounds
There is no workaround other than upgrading to uv 0.11.15.
Path traversal
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Uv