{"id":"EUVD-2026-106912","enisaUuid":"7c25f329-0d16-33eb-84aa-b2b969f75c7b","description":"uv before 0.11.15 contains a path traversal vulnerability that allows malicious wheels to write files outside the scripts directory via crafted console_scripts or gui_scripts entry point names. Attackers who induce users to install a malicious wheel can place executables in PATH directories, shadowing or overwriting existing binaries for code execution.","datePublished":"Oct 21, 2026, 12:37:08 AM","dateUpdated":"Oct 28, 2026, 4:15:57 PM","baseScore":8.7,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/astral-sh/uv/security/advisories/GHSA-4gg8-gxpx-9rph\nhttps://www.vulncheck.com/advisories/uv-before-0.11.15-arbitrary-file-write-via-entry-point-names\n","aliases":"CVE-2026-114109\nGHSA-m8vc-5xpp-qpqf\n","assigner":"VulnCheck","epss":0.38,"enisaIdProduct":[{"id":"3a68fefa-bb14-391d-a06f-96ed965ba099","product":{"name":"uv","vendor":{"name":"astral-sh"}},"product_version":"0 \u003c0.11.15"}],"enisaIdVendor":[{"id":"710bd849-b667-34c7-a244-f151b3bf39c8","vendor":{"name":"astral-sh"}}],"enisaIdVulnerability":[{"id":"52762080-7765-3712-a3ff-9b0fb7f718e0","vulnerability":{"id":"CVE-2026-114109","description":"uv before 0.11.15 contains a path traversal vulnerability that allows malicious wheels to write files outside the scripts directory via crafted console_scripts or gui_scripts entry point names. Attackers who induce users to install a malicious wheel can place executables in PATH directories, shadowing or overwriting existing binaries for code execution.","datePublished":"Oct 21, 2026, 12:37:08 AM","dateUpdated":"Oct 28, 2026, 4:15:57 PM","status":"PUBLISHED","baseScore":8.7,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/astral-sh/uv/security/advisories/GHSA-4gg8-gxpx-9rph\nhttps://www.vulncheck.com/advisories/uv-before-0.11.15-arbitrary-file-write-via-entry-point-names\n","enisa_id":"EUVD-2026-106912\n","assigner":"VulnCheck","epss":0.38,"dataProcessed":"Oct 30, 2026, 3:00:58 AM","vulnerabilityProduct":[{"id":"136a69c5-ebba-30e6-9861-23bde520d7f8","product":{"name":"uv","vendor":{"name":"astral-sh"}},"product_version":"0 \u003c0.11.15"}],"vulnerabilityVendor":[{"id":"04dde332-a688-3519-9a23-931cdf13ce70","vendor":{"name":"astral-sh"}}]}},{"id":"ba5984a0-4321-3f1c-aefc-15ed354c96ad","vulnerability":{"id":"GHSA-m8vc-5xpp-qpqf","description":"uv before 0.11.15 contains a path traversal vulnerability that allows malicious wheels to write files outside the scripts directory via crafted console_scripts or gui_scripts entry point names. Attackers who induce users to install a malicious wheel can place executables in PATH directories, shadowing or overwriting existing binaries for code execution.","datePublished":"Oct 21, 2026, 3:32:27 AM","dateUpdated":"Oct 21, 2026, 3:32:27 AM","baseScore":0.0,"references":"https://github.com/astral-sh/uv/security/advisories/GHSA-4gg8-gxpx-9rph\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-114109\nhttps://www.vulncheck.com/advisories/uv-before-0.11.15-arbitrary-file-write-via-entry-point-names\n","enisa_id":"EUVD-2026-106912\n","aliases":"CVE-2026-114109\nGHSA-m8vc-5xpp-qpqf\n","epss":0.0,"dataProcessed":"Oct 29, 2026, 7:03:23 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}