# Astral uv arbitrary file write via entry point path traversal

Source: https://junglewise.ai/threats/astral-uv-arbitrary-file-write-via-entry-point-path-traversal-1cff2f04  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-29. Updated: 2026-05-29  
License: CC BY 4.0 with a link back

Severity: medium · CVSS 0 · Published 2026-05-29

uv is a fast Python package and project manager. In affected versions, a security flaw allows a malicious Python package (wheel) to write executable files outside of the intended installation directory during the installation process. This could allow an attacker to overwrite or shadow legitimate system commands, leading to unauthorized code execution when a user runs what they believe to be a standard command.

Technologies: [uv (PyPI)](https://junglewise.ai/threats/technologies/uv). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Medium severity, with a CVSS score of 0, published 29 May 2026.

**Which products and versions are affected?** uv (PyPI) < 0.11.15.

**Is there a fix for This vulnerability?** A patch was published on 2026-05-18: uv version 0.11.15 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is This vulnerability attacked?** It is attacked with local access, in a software library.

**Am I affected?** Check whether you run uv (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A path traversal vulnerability (CWE-22) exists in uv's handling of entry point specifications (console_scripts or gui_scripts) within Python distributions. When installing a malicious wheel, uv fails to sufficiently validate that the generated entry point name remains within the environment's designated scripts directory. An attacker can provide a crafted entry point name that resolves to a path outside the environment, such as a directory already in the user's PATH. This allows for the overwriting or shadowing of existing executables, resulting in arbitrary code execution when the shadowed command is invoked. The vulnerability is fixed in version 0.11.15.

## Affected products

- Astral uv < 0.11.15

## Timeline

- 2026-05-18: disclosed: Advisory published by Astral-sh
- 2026-05-29: advisory: GitHub Advisory published
- 2026-05-18: patched: uv version 0.11.15 released

## References

- [https://api.github.com/users/zsol](https://api.github.com/users/zsol)
- [https://github.com/zsol](https://github.com/zsol)
- [https://api.github.com/users/zsol/gists%7B/gist_id%7D](https://api.github.com/users/zsol/gists%7B/gist_id%7D)
- [https://api.github.com/users/zsol/repos](https://api.github.com/users/zsol/repos)
- [https://avatars.githubusercontent.com/u/66740?v=4](https://avatars.githubusercontent.com/u/66740?v=4)
- [https://api.github.com/users/zsol/events%7B/privacy%7D](https://api.github.com/users/zsol/events%7B/privacy%7D)

## Related threats

- [Astral uv arbitrary file deletion through RECORD entries](https://junglewise.ai/threats/duplicate-advisory-uv-vulnerable-to-arbitrary-file-deletion-through-b611c497)
- [Astral uv compromised emSign CA root certificate](https://junglewise.ai/threats/pysec-2026-4321-uv-s-bundled-ca-store-trusts-an-emsign-root-whose-aeefabb5)
- [uv bundled CA store trusts compromised emSign root](https://junglewise.ai/threats/uv-s-bundled-ca-store-trusts-an-emsign-root-whose-intermediate-ca-keys-38269068)
- [uv path traversal in wheel extraction on Windows](https://junglewise.ai/threats/cve-2026-104843-uv-is-a-python-package-and-project-manager-written-in-rust-from)
- [PYSEC-2026-2001 - uv allows ZIP payload obfuscation through parsing differentials](https://junglewise.ai/threats/cve-2025-54368-uv-allows-zip-payload-obfuscation-through-parsing-differentials)