Description
A flaw was found in uv. This vulnerability allows an attacker to execute malicious code during package resolution or installation via specially crafted ZIP (Zipped Information Package) archives that exploit parsing differentials, requiring user interaction to install an attacker-controlled package.
Affected products
astral: uv
References10
- github.com/astral-sh/uv/security/advisories/GHSA-pqhf-p39g-3x64 Vendor Advisory
- github.com/astral-sh/uv/commit/da659fee4898a73dbc75070f3e82d49f… Patch
- access.redhat.com/errata/RHSA-2026:91219
- access.redhat.com/errata/RHSA-2026:91232
- access.redhat.com/errata/RHSA-2026:91236
- access.redhat.com/errata/RHSA-2026:94459
- access.redhat.com/errata/RHSA-2026:94476
- access.redhat.com/security/cve/CVE-2025-13327 Third Party Advisory
- bugzilla.redhat.com/show_bug.cgi?id=2407263 Issue Tracking
- github.com/astral-sh/uv Product
Metrics
- CVSS 3.1
-
6.3
MEDIUM
Score source: NVD
CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H - EPSS — exploit probability
- 0% percentile: 8 · as of 12 November 2026
- CWE
- CWE-1286
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.