PYSEC-2026-2295Published

Uv: uv: specially crafted zip archives lead to arbitrary code execution due to parsing differentials

Related advisories and sources

Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.

CVE-2025-13327 · CVE overview and exploitation status

cve-program · CVE-2025-13327

euvd · EUVD-2025-208130

nvd · CVE-2025-13327

osv · GHSA-v653-r55g-hcmg

Related changes

Linked by CVE identifier

A flaw was found in uv. This vulnerability allows an attacker to execute malicious code during package resolution or installation via specially crafted ZIP (Zipped Information Package) archives that exploit parsing differentials, requiring … · Advisory content revised · 15 Nov 2026
A flaw was found in uv. This vulnerability allows an attacker to execute malicious code during package resolution or installation via specially crafted ZIP (Zipped Information Package) archives that exploit parsing differentials, requiring … · Advisory content revised · 14 Nov 2026
Uv: uv: specially crafted zip archives lead to arbitrary code execution due to parsing differentials · Affected-version evidence changed · 13 Nov 2026
uv has ZIP payload obfuscation through parsing differentials · Advisory content revised · 13 Nov 2026
A flaw was found in uv. This vulnerability allows an attacker to execute malicious code during package resolution or installation via specially crafted ZIP (Zipped Information Package) archives that exploit parsing differentials, requiring … · Advisory content revised · 7 Nov 2026
A flaw was found in uv. This vulnerability allows an attacker to execute malicious code during package resolution or installation via specially crafted ZIP (Zipped Information Package) archives that exploit parsing differentials, requiring … · Advisory content revised · 6 Nov 2026
A flaw was found in uv. This vulnerability allows an attacker to execute malicious code during package resolution or installation via specially crafted ZIP (Zipped Information Package) archives that exploit parsing differentials, requiring … · Advisory content revised · 5 Nov 2026
Uv: uv: specially crafted zip archives lead to arbitrary code execution due to parsing differentials · Affected-version evidence changed · 4 Nov 2026
A flaw was found in uv. This vulnerability allows an attacker to execute malicious code during package resolution or installation via specially crafted ZIP (Zipped Information Package) archives that exploit parsing differentials, requiring … · Advisory content revised · 4 Nov 2026
uv has ZIP payload obfuscation through parsing differentials · Advisory content revised · 4 Nov 2026
Uv: uv: specially crafted zip archives lead to arbitrary code execution due to parsing differentials · Affected-version evidence changed · 3 Nov 2026
uv has ZIP payload obfuscation through parsing differentials · Advisory content revised · 3 Nov 2026
A flaw was found in uv. This vulnerability allows an attacker to execute malicious code during package resolution or installation via specially crafted ZIP (Zipped Information Package) archives that exploit parsing differentials, requiring … · Advisory content revised · 31 Oct 2026
A flaw was found in uv. This vulnerability allows an attacker to execute malicious code during package resolution or installation via specially crafted ZIP (Zipped Information Package) archives that exploit parsing differentials, requiring … · Advisory content revised · 31 Oct 2026