Quick answers
- Is CVE-2026-114110 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-114110 being exploited in the wild.
- How severe is CVE-2026-114110?
- Medium severity, with a CVSS score of 5.3, published 21 October 2026.
- Which products and versions are affected?
- Astral Uv before 0.11.6.
- Is there a fix for CVE-2026-114110?
- Yes: fixed in 0.11.6. Until then: Upgrade to uv 0.11.6 or newer. Users should avoid installing wheels from untrusted sources. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-114110 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-114110?
- Check whether you run Astral Uv at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: 0.11.6
Upgrade to uv 0.11.6 or newer. Users should avoid installing wheels from untrusted sources.
Technical details
The vulnerability is a path traversal flaw in uv's wheel uninstallation logic. Malicious wheels can include relative traversal paths (e.g., ../../../etc/passwd) in their RECORD entries; uv fails to validate these paths during installation and respects them during uninstall, deleting files outside the wheel's installation prefix. The attack requires the attacker to guess the installation depth and the user to actively install and uninstall the malicious wheel. A fix exists in version 0.11.6.
Affected products
- Astral uv before 0.11.6
Timeline
- 2026-04-09: disclosed
- 2026-04-09: patched: Version 0.11.6 released
- 2026-10-21: advisory