CVE-2026-104843 — uv: Path traversal on Windows through wheel extraction
uv is a Python package and project manager written in Rust. From 0.12.7 until 0.12.18, uv wheel extraction on Windows can process a malicious wheel in a way that writes a file o…
Published: 2026-10-02 · CVSS: 5.9 · CVSS 4.0
uv is a Python package and project manager written in Rust. From 0.12.7 until 0.12.18, uv wheel extraction on Windows can process a malicious wheel in a way that writes a file outside the installation prefix, including an executable in a directory already present on the user's PATH. Non-Windows hosts are not affected. This issue is fixed in version 0.12.18.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7