All vulnerabilities
CVE-2026-114109GHSA-4gg8-gxpx-9rph

uv: uv before 0.11.15 Arbitrary File Write via Entry Point Names

astral-sh uvPyPILibraries & packages
Open in ThreatlineRecord JSON
CVSS
8.7High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.38%Chance of exploitation activity in the next 30 days, higher than 30% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in0.11.15Fixed versionCVE List
Published21 Oct 2026Updated 21 Oct 2026CVE List

What fixes it

  • 0.11.15uvCVE List
  • 0.11.15uv, PyPIOSVpip install "uv>=0.11.15"

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

uv before 0.11.15 contains a path traversal vulnerability that allows malicious wheels to write files outside the scripts directory via crafted console_scripts or gui_scripts entry point names. Attackers who induce users to install a malicious wheel can place executables in PATH directories, shadowing or overwriting existing binaries for code execution.

Text from CVE List

Affected versions 54

  • uvaffected: all versions before 0.11.15CVE List
  • uvunaffected: 0.11.15CVE List
  • uv, PyPIfrom first release, fixed in 0.11.15OSV
  • uv, PyPI0.0.5OSV
  • uv, PyPI0.1.0OSV
  • uv, PyPI0.1.1OSV
  • uv, PyPI0.1.10OSV
  • uv, PyPI0.1.11OSV
  • uv, PyPI0.1.12OSV
  • uv, PyPI0.1.13OSV
  • uv, PyPI0.1.14OSV
  • uv, PyPI0.1.15OSV
  • uv, PyPI0.1.16OSV
  • uv, PyPI0.1.17OSV
  • uv, PyPI0.1.18OSV
  • uv, PyPI0.1.19OSV
  • uv, PyPI0.1.2OSV
  • uv, PyPI0.1.20OSV
  • uv, PyPI0.1.21OSV
  • uv, PyPI0.1.22OSV
  • uv, PyPI0.1.23OSV
  • uv, PyPI0.1.24OSV
  • uv, PyPI0.1.25OSV
  • uv, PyPI0.1.26OSV
  • uv, PyPI0.1.27OSV
  • uv, PyPI0.1.28OSV
  • uv, PyPI0.1.29OSV
  • uv, PyPI0.1.3OSV
  • uv, PyPI0.1.30OSV
  • uv, PyPI0.1.31OSV
  • uv, PyPI0.1.32OSV
  • uv, PyPI0.1.33OSV
  • uv, PyPI0.1.34OSV
  • uv, PyPI0.1.35OSV
  • uv, PyPI0.1.36OSV
  • uv, PyPI0.1.37OSV
  • uv, PyPI0.1.38OSV
  • uv, PyPI0.1.39OSV
  • uv, PyPI0.1.4OSV
  • uv, PyPI0.1.40OSV
  • uv, PyPI0.1.41OSV
  • uv, PyPI0.1.42OSV
  • uv, PyPI0.1.43OSV
  • uv, PyPI0.1.44OSV
  • uv, PyPI0.1.45OSV
  • uv, PyPI0.1.5OSV
  • uv, PyPI0.1.6OSV
  • uv, PyPI0.1.7OSV
  • uv, PyPI0.1.8OSV
  • uv, PyPI0.1.9OSV
  • uv, PyPI0.10.0OSV
  • uv, PyPI0.10.1OSV
  • uv, PyPI0.10.10OSV
  • uv, crates.iofrom first release, fixed in 0.11.15OSV

References 2