Uv: uv: specially crafted zip archives lead to arbitrary code execution due to parsing differentials
Historical advisory recorded 29 Oct 2026 23:48:55 UTC. Read the latest advisory.
cve-program · CVE-2025-13327
PublishedA flaw was found in uv. This vulnerability allows an attacker to execute malicious code during package resolution or installation via specially crafted ZIP (Zipped Information Package) archives that exploit parsing differentials, requiring user interaction to install an attacker-controlled package.
Read the publisher's advisoryAffected versions, risk and source history
cve-program · CVE-2025-13327
PublishedUv: uv: specially crafted zip archives lead to arbitrary code execution due to parsing differentials
A flaw was found in uv. This vulnerability allows an attacker to execute malicious code during package resolution or installation via specially crafted ZIP (Zipped Information Package) archives that exploit parsing differentials, requiring user interaction to install an attacker-controlled package.
- Source published
- 27 Feb 2026 07:30:20 UTC
- Source modified
- 29 Oct 2026 22:17:26 UTC
- Saved here
- 29 Oct 2026 23:48:55 UTC
- Source terms
- CVE Program Terms of Use
Original source record · Cite this exact observation · Complete original publisher JSON
Source: cve-program · CVE Program Terms of Use. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.
CVSS 3.1 · 6.3 CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H