CVE-2025-71437
CVE-2025-71437 · Astral uv through 0.8.21 Path Traversal via Symlinks in Sdist Tar Extraction
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
Astral uv before 0.8.22 contains a path traversal vulnerability in source distribution (sdist) tar extraction that allows a specially crafted sequence of symlinks to redirect file writes outside the intended extraction prefix. Attackers can publish a malicious sdist that, when installed by a victim, writes arbitrary files to filesystem locations outside the installation prefix.
CVSS 8.7 · Alta · EPSS 0,3%
- Publicación
- Actualización
Pila tecnológica: system