{"schema_version":1,"title":"Astral Uv vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 8 vulnerabilities in Astral Uv: 0 in the last 7 days and 7 in the last 90 days, 1 of them critical and 0 exploited in the wild. The most recent, Astral uv arbitrary file deletion through RECORD entries, was published on 21 October 2026. 6 vulnerabilities in the last four weeks, up 500% on the four before (1). 1 critical against 0.","url":"https://junglewise.ai/threats/technologies/astral-uv","json_url":"https://junglewise.ai/threats/technologies/astral-uv.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/technologies/astral-uv","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"technology","thin":false,"counts":{"high":1,"all_time":8,"critical":1,"exploited":0,"last_7_days":0,"last_30_days":6,"last_90_days":7,"last_365_days":8},"latest":[{"cvss":5.3,"slug":"duplicate-advisory-uv-vulnerable-to-arbitrary-file-deletion-through-b611c497","title":"Astral uv arbitrary file deletion through RECORD entries","severity":"medium","exploited":false,"published_at":"2026-10-21T03:32:27+00:00","url":"https://junglewise.ai/threats/duplicate-advisory-uv-vulnerable-to-arbitrary-file-deletion-through-b611c497"},{"cve":"CVE-2026-114110","cvss":5.3,"slug":"cve-2026-114110-astral-uv-before-0-11-6-contains-a-path-traversal-vulnerability","title":"Astral uv path traversal via RECORD entries","severity":"medium","exploited":false,"published_at":"2026-10-21T01:17:37.103+00:00","url":"https://junglewise.ai/threats/cve-2026-114110-astral-uv-before-0-11-6-contains-a-path-traversal-vulnerability"},{"cve":"CVE-2026-114109","cvss":8.8,"slug":"cve-2026-114109-uv-before-0-11-15-contains-a-path-traversal-vulnerability-that","title":"Astral uv path traversal via entry point names","severity":"high","exploited":false,"published_at":"2026-10-21T01:17:36.957+00:00","url":"https://junglewise.ai/threats/cve-2026-114109-uv-before-0-11-15-contains-a-path-traversal-vulnerability-that"},{"cve":"CVE-2025-71437","cvss":6.5,"slug":"cve-2025-71437-astral-uv-before-0-8-22-contains-a-path-traversal-vulnerability","title":"Astral uv path traversal in sdist tar extraction","severity":"medium","exploited":false,"published_at":"2026-10-21T01:17:19.493+00:00","url":"https://junglewise.ai/threats/cve-2025-71437-astral-uv-before-0-8-22-contains-a-path-traversal-vulnerability"},{"cvss":4,"slug":"pysec-2026-4321-uv-s-bundled-ca-store-trusts-an-emsign-root-whose-aeefabb5","title":"Astral uv compromised emSign CA root certificate","severity":"medium","exploited":false,"published_at":"2026-10-20T21:49:27.535265+00:00","url":"https://junglewise.ai/threats/pysec-2026-4321-uv-s-bundled-ca-store-trusts-an-emsign-root-whose-aeefabb5"},{"cvss":4,"slug":"uv-s-bundled-ca-store-trusts-an-emsign-root-whose-intermediate-ca-keys-38269068","title":"uv bundled CA store trusts compromised emSign root","severity":"critical","exploited":false,"published_at":"2026-10-20T19:37:52+00:00","url":"https://junglewise.ai/threats/uv-s-bundled-ca-store-trusts-an-emsign-root-whose-intermediate-ca-keys-38269068"},{"cve":"CVE-2026-104843","cvss":4,"epss":0.0043,"slug":"cve-2026-104843-uv-is-a-python-package-and-project-manager-written-in-rust-from","title":"uv path traversal in wheel extraction on Windows","severity":"medium","exploited":false,"published_at":"2026-10-02T16:16:46.76+00:00","url":"https://junglewise.ai/threats/cve-2026-104843-uv-is-a-python-package-and-project-manager-written-in-rust-from"},{"cve":"CVE-2025-13327","cvss":6.3,"epss":0.0017,"slug":"cve-2025-13327-uv-allows-zip-payload-obfuscation-through-parsing-differentials","title":"uv has ZIP payload obfuscation through parsing differentials","severity":"medium","exploited":false,"published_at":"2026-02-27T08:17:04.043+00:00","url":"https://junglewise.ai/threats/cve-2025-13327-uv-allows-zip-payload-obfuscation-through-parsing-differentials"}],"weekly":[{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-28","critical":0,"exploited":0,"vulnerabilities":1},{"week":"2026-10-05","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-12","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-19","critical":1,"exploited":0,"vulnerabilities":6},{"week":"2026-10-26","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-11-02","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-11-09","critical":0,"exploited":0,"vulnerabilities":0}],"related":[],"technology":{"hub":true,"name":"Astral Uv","slug":"astral-uv","vendor":{"hub":true,"name":"Astral","slug":"astral","url":"https://junglewise.ai/threats/vendors/astral"},"aliases":[],"category":"package-manager","homepage":"https://docs.astral.sh/uv","repo_url":"https://github.com/astral-sh/uv","description":"Python package installer and resolver emphasizing speed and reliability.","url":"https://junglewise.ai/threats/technologies/astral-uv"},"most_severe":[{"cvss":4,"slug":"uv-s-bundled-ca-store-trusts-an-emsign-root-whose-intermediate-ca-keys-38269068","title":"uv bundled CA store trusts compromised emSign root","severity":"critical","exploited":false,"published_at":"2026-10-20T19:37:52+00:00","url":"https://junglewise.ai/threats/uv-s-bundled-ca-store-trusts-an-emsign-root-whose-intermediate-ca-keys-38269068"},{"cve":"CVE-2026-114109","cvss":8.8,"slug":"cve-2026-114109-uv-before-0-11-15-contains-a-path-traversal-vulnerability-that","title":"Astral uv path traversal via entry point names","severity":"high","exploited":false,"published_at":"2026-10-21T01:17:36.957+00:00","url":"https://junglewise.ai/threats/cve-2026-114109-uv-before-0-11-15-contains-a-path-traversal-vulnerability-that"},{"cve":"CVE-2025-71437","cvss":6.5,"slug":"cve-2025-71437-astral-uv-before-0-8-22-contains-a-path-traversal-vulnerability","title":"Astral uv path traversal in sdist tar extraction","severity":"medium","exploited":false,"published_at":"2026-10-21T01:17:19.493+00:00","url":"https://junglewise.ai/threats/cve-2025-71437-astral-uv-before-0-8-22-contains-a-path-traversal-vulnerability"},{"cve":"CVE-2025-13327","cvss":6.3,"epss":0.0017,"slug":"cve-2025-13327-uv-allows-zip-payload-obfuscation-through-parsing-differentials","title":"uv has ZIP payload obfuscation through parsing differentials","severity":"medium","exploited":false,"published_at":"2026-02-27T08:17:04.043+00:00","url":"https://junglewise.ai/threats/cve-2025-13327-uv-allows-zip-payload-obfuscation-through-parsing-differentials"},{"cvss":5.3,"slug":"duplicate-advisory-uv-vulnerable-to-arbitrary-file-deletion-through-b611c497","title":"Astral uv arbitrary file deletion through RECORD entries","severity":"medium","exploited":false,"published_at":"2026-10-21T03:32:27+00:00","url":"https://junglewise.ai/threats/duplicate-advisory-uv-vulnerable-to-arbitrary-file-deletion-through-b611c497"},{"cve":"CVE-2026-114110","cvss":5.3,"slug":"cve-2026-114110-astral-uv-before-0-11-6-contains-a-path-traversal-vulnerability","title":"Astral uv path traversal via RECORD entries","severity":"medium","exploited":false,"published_at":"2026-10-21T01:17:37.103+00:00","url":"https://junglewise.ai/threats/cve-2026-114110-astral-uv-before-0-11-6-contains-a-path-traversal-vulnerability"},{"cve":"CVE-2026-104843","cvss":4,"epss":0.0043,"slug":"cve-2026-104843-uv-is-a-python-package-and-project-manager-written-in-rust-from","title":"uv path traversal in wheel extraction on Windows","severity":"medium","exploited":false,"published_at":"2026-10-02T16:16:46.76+00:00","url":"https://junglewise.ai/threats/cve-2026-104843-uv-is-a-python-package-and-project-manager-written-in-rust-from"},{"cvss":4,"slug":"pysec-2026-4321-uv-s-bundled-ca-store-trusts-an-emsign-root-whose-aeefabb5","title":"Astral uv compromised emSign CA root certificate","severity":"medium","exploited":false,"published_at":"2026-10-20T21:49:27.535265+00:00","url":"https://junglewise.ai/threats/pysec-2026-4321-uv-s-bundled-ca-store-trusts-an-emsign-root-whose-aeefabb5"}],"generated_at":"2026-11-09T03:07:00.176479+00:00"}