{"schema":"threatline.record/2","record":{"id":"CVE-2026-114109","aliases":["GHSA-4gg8-gxpx-9rph"],"summary":"uv before 0.11.15 Arbitrary File Write via Entry Point Names","details":"uv before 0.11.15 contains a path traversal vulnerability that allows malicious wheels to write files outside the scripts directory via crafted console_scripts or gui_scripts entry point names. Attackers who induce users to install a malicious wheel can place executables in PATH directories, shadowing or overwriting existing binaries for code execution.","categories":["Libraries & packages"],"product":"uv","vendor":"astral-sh","ecosystem":"PyPI","affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-114109","source_modified_at":"2026-10-21T00:37:08.897Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"uv","vendor":"astral-sh","versions":[{"lessThan":"0.11.15","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"0.11.15","versionType":"semver"}],"defaultStatus":"unaffected"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-114109","source_modified_at":"2026-10-21T00:37:08.897Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"uv","vendor":"astral-sh","versions":[{"lessThan":"0.11.15","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"0.11.15","versionType":"semver"}],"defaultStatus":"unaffected"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-4gg8-gxpx-9rph","source_modified_at":"2026-10-21T10:57:22.076639061Z","fetched_at":"2026-10-23T18:55:00.935475Z","package":{"name":"uv","ecosystem":"PyPI","purl":"pkg:pypi/uv"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.11.15"}]}],"versions":["0.0.5","0.1.0","0.1.1","0.1.10","0.1.11","0.1.12","0.1.13","0.1.14","0.1.15","0.1.16","0.1.17","0.1.18","0.1.19","0.1.2","0.1.20","0.1.21","0.1.22","0.1.23","0.1.24","0.1.25","0.1.26","0.1.27","0.1.28","0.1.29","0.1.3","0.1.30","0.1.31","0.1.32","0.1.33","0.1.34","0.1.35","0.1.36","0.1.37","0.1.38","0.1.39","0.1.4","0.1.40","0.1.41","0.1.42","0.1.43","0.1.44","0.1.45","0.1.5","0.1.6","0.1.7","0.1.8","0.1.9","0.10.0","0.10.1","0.10.10"]},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-4gg8-gxpx-9rph","source_modified_at":"2026-10-21T10:57:22.076639061Z","fetched_at":"2026-10-23T18:55:00.935475Z","package":{"name":"uv","ecosystem":"crates.io","purl":"pkg:cargo/uv"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.11.15"}]}],"versions":[]}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-114109","source_modified_at":"2026-10-21T00:37:08.897Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"uv","ecosystem":null},"version":"0.11.15","basis":"first unaffected version stated in the CVE record"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-4gg8-gxpx-9rph","source_modified_at":"2026-10-21T10:57:22.076639061Z","fetched_at":"2026-10-23T18:55:00.935475Z","package":{"name":"uv","ecosystem":"PyPI","purl":"pkg:pypi/uv"},"version":"0.11.15"}],"cvss":8.7,"severity":"High","kev":{"listed":false},"epss":{"probability":0.00381,"percentile":0.30953,"score_date":"2026-10-23"},"published_at":"2026-10-21T00:37:08.897Z","modified_at":"2026-10-21T10:57:22.076639061Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-114109","fetched_at":"2026-10-23T18:45:31.882637Z","source_modified_at":"2026-10-21T00:37:08.897Z"},{"source":"OSV","url":"https://osv.dev/vulnerability/GHSA-4gg8-gxpx-9rph","fetched_at":"2026-10-23T18:55:00.935475Z","source_modified_at":"2026-10-21T10:57:22.076639061Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114109","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","OSV","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/astral-sh/uv/security/advisories/GHSA-4gg8-gxpx-9rph","tags":["vendor-advisory"]},{"source":"CVE List","url":"https://www.vulncheck.com/advisories/uv-before-0.11.15-arbitrary-file-write-via-entry-point-names","tags":["third-party-advisory"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"ecosystem","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-21T10:57:22.076639061Z","content_hash":"6eeffd3b85483ae36fdb76d00f63e9acc2ecd8742f66ce1bc4a66dff92762d71"}}