{"id":"GHSA-2cv4-cqwr-gwf7","revision":"d53eab3e84614a44adee36ed5722ded0","records":[{"revision":"d53eab3e84614a44adee36ed5722ded0","observedAt":"2026-10-24T13:19:54.901+00:00","statement":{"source":"osv","id":"GHSA-2cv4-cqwr-gwf7","aliases":["CVE-2026-104843","PYSEC-2026-4305"],"title":"uv: Path traversal on Windows through wheel extraction","description":"### Impact\n\nIn versions of uv from 0.12.7 to 0.12.18 on Windows, uv could be induced into writing a file outside of the installation prefix during wheel installation.\n\nA malicious wheel could use this to place an executable outside of the intended environment, including in a directory already present on the user's PATH. \n\nThis vulnerability only affects Windows hosts; no other platforms are affected.\n\n### Patches\n\nuv 0.12.18 and newer address this vulnerability. Users are encouraged to upgrade to 0.12.18.\n\n### Workarounds\n\nThere is no workaround other than upgrading to uv 0.12.18.","state":0,"publishedAt":"2026-10-05T23:42:09+00:00","modifiedAt":"2026-10-15T14:55:34.9002241+00:00","affected":[{"ecosystem":"PyPI","name":"uv","ranges":[{"type":"ECOSYSTEM","events":[{"kind":"introduced","version":"0.12.7"},{"kind":"fixed","version":"0.12.18"}]}],"versions":["0.12.10","0.12.11","0.12.12","0.12.13","0.12.14","0.12.15","0.12.16","0.12.17","0.12.7","0.12.8","0.12.9"],"rawVersionEvidence":null},{"ecosystem":"crates.io","name":"uv","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0.12.7"},{"kind":"fixed","version":"0.12.18"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V4","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://github.com/astral-sh/uv/security/advisories/GHSA-2cv4-cqwr-gwf7","https://nvd.nist.gov/vuln/detail/CVE-2026-104843","https://github.com/astral-sh/uv/pull/21923","https://github.com/astral-sh/uv/commit/67169645278ce082638d619beefa6d062540843b","https://github.com/astral-sh/uv","https://github.com/astral-sh/uv/releases/tag/0.12.18"],"sourceUrl":"https://github.com/advisories/GHSA-2cv4-cqwr-gwf7","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-2cv4-cqwr-gwf7","identifiers":["GHSA-2cv4-cqwr-gwf7","CVE-2026-104843","PYSEC-2026-4305"]},"retained":false,"historicalAffected":[]}],"coverage":[]}