p PatchFirst

CVE-2026-104843

CVE-2026-104843 · uv: Path traversal on Windows through wheel extraction

This page contains facts from public vulnerability sources. Check the original advisory before updating.

uv is a Python package and project manager written in Rust. From 0.12.7 until 0.12.18, uv wheel extraction on Windows can process a malicious wheel in a way that writes a file outside the installation prefix, including an executable in a directory already present on the user's PATH. Non-Windows hosts are not affected. This issue is fixed in version 0.12.18.

CVSS 5.9 · Medium · EPSS 0.4% · Fix available

Published
Updated

Stack: system · python

Affected products and versions

  • uv

    Versions
    • >= 0.12.7, < 0.12.18: Affected

    No fix published

  • uv PyPI

    Versions
    • 0.12.10
    • 0.12.11
    • 0.12.12
    • 0.12.13
    • 0.12.14
    • 0.12.15
    • 0.12.16
    • 0.12.17
    • 0.12.7
    • 0.12.8
    • 0.12.9
    Affected ranges
    • ECOSYSTEM: ≥ 0.12.7, < 0.12.18

    Update to 0.12.18

  • uv crates.io

    Affected ranges
    • SEMVER: ≥ 0.12.7, < 0.12.18

    Update to 0.12.18

  • uv Ubuntu:26.10

    Versions
    • 0.9.17+ds1-3
    • 0.9.17+ds1-4
    • 0.9.17+ds1-5
    • 0.9.17+ds1-6
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • uv-full Ubuntu:26.10

    Versions
    • 0.11.20+ds-0ubuntu1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →