HIGH 8.7 NVD
CVE-2025-71437
Astral uv before 0.8.22 contains a path traversal vulnerability in source distribution (sdist) tar extraction that allows a specially crafted sequence of symlin
Astral uv before 0.8.22 contains a path traversal vulnerability in source distribution (sdist) tar extraction that allows a specially crafted sequence of symlinks to redirect file writes outside the intended extraction prefix. Attackers can publish a malicious sdist that, when installed by a victim, writes arbitrary files to filesystem locations outside the installation prefix.
References
- https://github.com/astral-sh/uv/security/advisories/GHSA-7j9j-68r2-f35q
- https://www.vulncheck.com/advisories/astral-uv-through-0.8.21-path-traversal-via-symlinks-
This high severity vulnerability with a CVSS score of 8.7 was published on 2026-10-21 via NVD.
vulnfeed aggregates 18180 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.