Quick answers
- Is CVE-2025-71437 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2025-71437 being exploited in the wild.
- How severe is CVE-2025-71437?
- Medium severity, with a CVSS score of 6.5, published 21 October 2026.
- Which products and versions are affected?
- Astral Uv before 0.8.22.
- Is there a fix for CVE-2025-71437?
- Yes: fixed in 0.8.22 and newer. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2025-71437 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2025-71437?
- Check whether you run Astral Uv at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: 0.8.22 and newer
Technical details
The vulnerability is a path traversal in tar extraction (CWE-22) affecting sdist handling in uv versions ≤0.8.21. An attacker can craft a source distribution with a specially crafted sequence of symlinks that causes the extraction process to write files outside the intended prefix. The attack requires no authentication or user interaction beyond installing a malicious package, but is limited to sdist (source distribution) installs; wheel installations are not affected.
Affected products
- Astral uv before 0.8.22
Timeline
- 2025-09-23: disclosed
- 2025-09-23: patched: uv 0.8.22 and newer address the vulnerability