CVE-2025-13327
Uv: uv: specially crafted zip archives lead to arbitrary code execution due to parsing differentials
CVSS 3.1 6.3 MEDIUMEUVD CVSS 3.1 6.3 CVSS 3.1 · [email protected] · Secondary 6.3 MEDIUMCVSS 3.1 · [email protected] · Primary 6.3 MEDIUMCVSS_V3 Publisher rating MODERATEFixed by uv 0.9.6KEV status unknown
cve-program · CVE-2025-13327
PublishedA flaw was found in uv. This vulnerability allows an attacker to execute malicious code during package resolution or installation via specially crafted ZIP (Zipped Information Package) archives that exploit parsing differentials, requiring user interaction to install an attacker-controlled package.
Read the publisher's advisoryeuvd · EUVD-2025-208130
PublishedA flaw was found in uv. This vulnerability allows an attacker to execute malicious code during package resolution or installation via specially crafted ZIP (Zipped Information Package) archives that exploit parsing differentials, requiring user interaction to install an attacker-controlled package.
Read the publisher's advisorynvd · CVE-2025-13327
PublishedA flaw was found in uv. This vulnerability allows an attacker to execute malicious code during package resolution or installation via specially crafted ZIP (Zipped Information Package) archives that exploit parsing differentials, requiring user interaction to install an attacker-controlled package.
Read the publisher's advisoryosv · GHSA-v653-r55g-hcmg
PublishedA flaw was found in uv. This vulnerability allows an attacker to execute malicious code during package resolution or installation via specially crafted ZIP (Zipped Information Package) archives that exploit parsing differentials, requiring user interaction to install an attacker-controlled package.
Read the publisher's advisoryAffected versions, risk and source history
Related advisories and sources
Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.
CVE-2025-13327 · CVE overview and exploitation status
cve-program · CVE-2025-13327
- https://access.redhat.com/errata/RHSA-2026:91219
- https://access.redhat.com/errata/RHSA-2026:91232
- https://access.redhat.com/errata/RHSA-2026:91236
- https://access.redhat.com/errata/RHSA-2026:94459
- https://access.redhat.com/errata/RHSA-2026:94476
- https://access.redhat.com/errata/RHSA-2026:96400
- https://access.redhat.com/errata/RHSA-2026:96403
- https://access.redhat.com/errata/RHSA-2026:96406
- https://access.redhat.com/security/cve/CVE-2025-13327
- https://bugzilla.redhat.com/show_bug.cgi?id=2407263
- https://github.com/astral-sh/uv
- https://github.com/astral-sh/uv/commit/da659fee4898a73dbc75070f3e82d49f745e4628
- https://github.com/astral-sh/uv/security/advisories/GHSA-pqhf-p39g-3x64
euvd · EUVD-2025-208130
- https://access.redhat.com/errata/RHSA-2026:91219
- https://access.redhat.com/errata/RHSA-2026:91232
- https://access.redhat.com/errata/RHSA-2026:91236
- https://access.redhat.com/errata/RHSA-2026:94459
- https://access.redhat.com/errata/RHSA-2026:94476
- https://access.redhat.com/errata/RHSA-2026:96400
- https://access.redhat.com/errata/RHSA-2026:96403
- https://access.redhat.com/errata/RHSA-2026:96406
- https://access.redhat.com/security/cve/CVE-2025-13327
- https://bugzilla.redhat.com/show_bug.cgi?id=2407263
- https://github.com/astral-sh/uv
- https://github.com/astral-sh/uv/commit/da659fee4898a73dbc75070f3e82d49f745e4628
- https://github.com/astral-sh/uv/security/advisories/GHSA-pqhf-p39g-3x64
nvd · CVE-2025-13327
- https://access.redhat.com/errata/RHSA-2026:91219
- https://access.redhat.com/errata/RHSA-2026:91232
- https://access.redhat.com/errata/RHSA-2026:91236
- https://access.redhat.com/errata/RHSA-2026:94459
- https://access.redhat.com/errata/RHSA-2026:94476
- https://access.redhat.com/errata/RHSA-2026:96400
- https://access.redhat.com/errata/RHSA-2026:96403
- https://access.redhat.com/errata/RHSA-2026:96406
- https://access.redhat.com/security/cve/CVE-2025-13327
- https://bugzilla.redhat.com/show_bug.cgi?id=2407263
- https://github.com/astral-sh/uv
- https://github.com/astral-sh/uv/commit/da659fee4898a73dbc75070f3e82d49f745e4628
- https://github.com/astral-sh/uv/security/advisories/GHSA-pqhf-p39g-3x64
osv · GHSA-v653-r55g-hcmg
- https://github.com/astral-sh/uv/security/advisories/GHSA-pqhf-p39g-3x64
- https://nvd.nist.gov/vuln/detail/CVE-2025-13327
- https://github.com/astral-sh/uv/commit/da659fee4898a73dbc75070f3e82d49f745e4628
- https://access.redhat.com/errata/RHSA-2026:91219
- https://access.redhat.com/errata/RHSA-2026:91232
- https://access.redhat.com/errata/RHSA-2026:91236
- https://access.redhat.com/errata/RHSA-2026:94459
- https://access.redhat.com/errata/RHSA-2026:94476
- https://access.redhat.com/errata/RHSA-2026:96400
- https://access.redhat.com/errata/RHSA-2026:96403
- https://access.redhat.com/errata/RHSA-2026:96406
- https://access.redhat.com/security/cve/CVE-2025-13327
- https://bugzilla.redhat.com/show_bug.cgi?id=2407263
- https://github.com/astral-sh/uv
Related changes
Linked by CVE identifier- A flaw was found in uv. This vulnerability allows an attacker to execute malicious code during package resolution or installation via specially crafted ZIP (Zipped Information Package) archives that exploit parsing differentials, requiring … · Advisory content revised · 15 Nov 2026
- A flaw was found in uv. This vulnerability allows an attacker to execute malicious code during package resolution or installation via specially crafted ZIP (Zipped Information Package) archives that exploit parsing differentials, requiring … · Advisory content revised · 14 Nov 2026
- Uv: uv: specially crafted zip archives lead to arbitrary code execution due to parsing differentials · Affected-version evidence changed · 13 Nov 2026
- uv has ZIP payload obfuscation through parsing differentials · Advisory content revised · 13 Nov 2026
- A flaw was found in uv. This vulnerability allows an attacker to execute malicious code during package resolution or installation via specially crafted ZIP (Zipped Information Package) archives that exploit parsing differentials, requiring … · Advisory content revised · 7 Nov 2026
- A flaw was found in uv. This vulnerability allows an attacker to execute malicious code during package resolution or installation via specially crafted ZIP (Zipped Information Package) archives that exploit parsing differentials, requiring … · Advisory content revised · 6 Nov 2026
- A flaw was found in uv. This vulnerability allows an attacker to execute malicious code during package resolution or installation via specially crafted ZIP (Zipped Information Package) archives that exploit parsing differentials, requiring … · Advisory content revised · 5 Nov 2026
- Uv: uv: specially crafted zip archives lead to arbitrary code execution due to parsing differentials · Affected-version evidence changed · 4 Nov 2026
- A flaw was found in uv. This vulnerability allows an attacker to execute malicious code during package resolution or installation via specially crafted ZIP (Zipped Information Package) archives that exploit parsing differentials, requiring … · Advisory content revised · 4 Nov 2026
- uv has ZIP payload obfuscation through parsing differentials · Advisory content revised · 4 Nov 2026
- Uv: uv: specially crafted zip archives lead to arbitrary code execution due to parsing differentials · Affected-version evidence changed · 3 Nov 2026
- uv has ZIP payload obfuscation through parsing differentials · Advisory content revised · 3 Nov 2026
- A flaw was found in uv. This vulnerability allows an attacker to execute malicious code during package resolution or installation via specially crafted ZIP (Zipped Information Package) archives that exploit parsing differentials, requiring … · Advisory content revised · 31 Oct 2026
- A flaw was found in uv. This vulnerability allows an attacker to execute malicious code during package resolution or installation via specially crafted ZIP (Zipped Information Package) archives that exploit parsing differentials, requiring … · Advisory content revised · 31 Oct 2026
- uv has ZIP payload obfuscation through parsing differentials · Advisory content revised · 30 Oct 2026