All vulnerabilities
CVE-2026-104843GHSA-2cv4-cqwr-gwf7PYSEC-2026-4305

uv: uv: Path traversal on Windows through wheel extraction

astral-sh uvpipLibraries & packages
Open in ThreatlineRecord JSON
CVSS
5.9Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.43%Chance of exploitation activity in the next 30 days, higher than 35% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in0.12.18Fixed versionGitHub
Published2 Oct 2026Updated 15 Oct 2026CVE List

What fixes it

  • 0.12.18uv, pipGitHub
  • 0.12.18uv, PyPIOSVpip install "uv>=0.12.18"

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Impact

In versions of uv from 0.12.7 to 0.12.18 on Windows, uv could be induced into writing a file outside of the installation prefix during wheel installation.

A malicious wheel could use this to place an executable outside of the intended environment, including in a directory already present on the user's PATH.

This vulnerability only affects Windows hosts; no other platforms are affected.

Patches

uv 0.12.18 and newer address this vulnerability. Users are encouraged to upgrade to 0.12.18.

Workarounds

There is no workaround other than upgrading to uv 0.12.18.

Text from GitHub Advisory Database

Affected versions 16

  • uv, pip>= 0.12.7, < 0.12.18GitHub
  • uv, rust>= 0.12.7, < 0.12.18GitHub
  • uvaffected: >= 0.12.7, < 0.12.18CVE List
  • uv, PyPIfrom 0.12.7, fixed in 0.12.18OSV
  • uv, PyPI0.12.10OSV
  • uv, PyPI0.12.11OSV
  • uv, PyPI0.12.12OSV
  • uv, PyPI0.12.13OSV
  • uv, PyPI0.12.14OSV
  • uv, PyPI0.12.15OSV
  • uv, PyPI0.12.16OSV
  • uv, PyPI0.12.17OSV
  • uv, PyPI0.12.7OSV
  • uv, PyPI0.12.8OSV
  • uv, PyPI0.12.9OSV
  • uv, crates.iofrom 0.12.7, fixed in 0.12.18OSV

References 6