{"id":"EUVD-2026-91675","enisaUuid":"45db7019-03fb-374e-86d9-b54d4898f53c","description":"uv is a Python package and project manager written in Rust. From 0.12.7 until 0.12.18, uv wheel extraction on Windows can process a malicious wheel in a way that writes a file outside the installation prefix, including an executable in a directory already present on the user\u0027s PATH. Non-Windows hosts are not affected. This issue is fixed in version 0.12.18.","datePublished":"Oct 2, 2026, 3:29:15 PM","dateUpdated":"Oct 2, 2026, 4:00:53 PM","baseScore":5.9,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/astral-sh/uv/security/advisories/GHSA-2cv4-cqwr-gwf7\nhttps://github.com/astral-sh/uv/pull/21923\nhttps://github.com/astral-sh/uv/commit/67169645278ce082638d619beefa6d062540843b\nhttps://github.com/astral-sh/uv/releases/tag/0.12.18\n","aliases":"CVE-2026-104843\nGHSA-2cv4-cqwr-gwf7\n","assigner":"GitHub_M","epss":0.42,"enisaIdProduct":[{"id":"200daa96-ce4a-3fee-bf8b-ab4c23023e88","product":{"name":"uv","vendor":{"name":"astral-sh"}},"product_version":"0.12.7, \u003c 0.12.18"}],"enisaIdVendor":[{"id":"36167fac-1ae7-314c-bb3c-0a2f30825195","vendor":{"name":"astral-sh"}}],"enisaIdVulnerability":[{"id":"22680af3-fdfd-32d7-8a8e-89ef9b080a63","vulnerability":{"id":"PYSEC-2026-4305","description":"uv: Path traversal on Windows through wheel extraction","datePublished":"Oct 15, 2026, 10:22:45 AM","dateUpdated":"Oct 15, 2026, 2:38:12 PM","baseScore":0.0,"references":"https://github.com/astral-sh/uv/security/advisories/GHSA-2cv4-cqwr-gwf7\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-104843\nhttps://github.com/astral-sh/uv/pull/21923\nhttps://github.com/astral-sh/uv/commit/67169645278ce082638d619beefa6d062540843b\nhttps://github.com/astral-sh/uv\nhttps://github.com/astral-sh/uv/releases/tag/0.12.18\nhttps://pypi.org/project/uv\nhttps://github.com/advisories/GHSA-2cv4-cqwr-gwf7\n","enisa_id":"EUVD-2026-91675\n","aliases":"CVE-2026-104843\nGHSA-2cv4-cqwr-gwf7\n","epss":0.0,"dataProcessed":"Nov 5, 2026, 5:01:42 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"f30a1a6a-1502-3ba1-8ad3-bdfc16ef6299","vulnerability":{"id":"CVE-2026-104843","description":"uv is a Python package and project manager written in Rust. From 0.12.7 until 0.12.18, uv wheel extraction on Windows can process a malicious wheel in a way that writes a file outside the installation prefix, including an executable in a directory already present on the user\u0027s PATH. Non-Windows hosts are not affected. This issue is fixed in version 0.12.18.","datePublished":"Oct 2, 2026, 3:29:15 PM","dateUpdated":"Oct 2, 2026, 4:00:53 PM","status":"PUBLISHED","baseScore":5.9,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/astral-sh/uv/security/advisories/GHSA-2cv4-cqwr-gwf7\nhttps://github.com/astral-sh/uv/pull/21923\nhttps://github.com/astral-sh/uv/commit/67169645278ce082638d619beefa6d062540843b\nhttps://github.com/astral-sh/uv/releases/tag/0.12.18\n","enisa_id":"EUVD-2026-91675\n","assigner":"GitHub_M","epss":0.42,"dataProcessed":"Nov 4, 2026, 7:15:20 AM","vulnerabilityProduct":[{"id":"bfd5ae8d-2011-38f1-96e3-0634b28f2364","product":{"name":"uv","vendor":{"name":"astral-sh"}},"product_version":"0.12.7, \u003c 0.12.18"}],"vulnerabilityVendor":[{"id":"1a7ac670-b952-311b-9c59-73e843f4f54d","vendor":{"name":"astral-sh"}}]}},{"id":"feb126c2-1840-393b-9f79-a64f15c0e073","vulnerability":{"id":"GHSA-2cv4-cqwr-gwf7","description":"uv: Path traversal on Windows through wheel extraction","datePublished":"Oct 5, 2026, 11:42:09 PM","dateUpdated":"Oct 5, 2026, 11:42:09 PM","baseScore":0.0,"references":"https://github.com/astral-sh/uv/security/advisories/GHSA-2cv4-cqwr-gwf7\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-104843\nhttps://github.com/astral-sh/uv/pull/21923\nhttps://github.com/astral-sh/uv/commit/67169645278ce082638d619beefa6d062540843b\nhttps://github.com/astral-sh/uv\nhttps://github.com/astral-sh/uv/releases/tag/0.12.18\n","enisa_id":"EUVD-2026-91675\n","aliases":"GHSA-2cv4-cqwr-gwf7\nCVE-2026-104843\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:07:07 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}