HIGH 8.7 NVD
CVE-2026-114109
uv before 0.11.15 contains a path traversal vulnerability that allows malicious wheels to write files outside the scripts directory via crafted console_scripts
uv before 0.11.15 contains a path traversal vulnerability that allows malicious wheels to write files outside the scripts directory via crafted console_scripts or gui_scripts entry point names. Attackers who induce users to install a malicious wheel can place executables in PATH directories, shadowing or overwriting existing binaries for code execution.
References
- https://github.com/astral-sh/uv/security/advisories/GHSA-4gg8-gxpx-9rph
- https://www.vulncheck.com/advisories/uv-before-0.11.15-arbitrary-file-write-via-entry-poin
This high severity vulnerability with a CVSS score of 8.7 was published on 2026-10-21 via NVD.
vulnfeed aggregates 18180 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.