{"schema_version":1,"title":"Astral vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 11 vulnerabilities in Astral: 0 in the last 7 days and 8 in the last 90 days, 1 of them critical and 0 exploited in the wild. The most recent, Astral astral-tokio-tar library unmaintained, was published on 3 November 2026. 7 vulnerabilities in the last four weeks, up 600% on the four before (1). 1 critical against 0. 1 technology has a page of its own.","url":"https://junglewise.ai/threats/vendors/astral","json_url":"https://junglewise.ai/threats/vendors/astral.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/vendors/astral","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"vendor","thin":false,"counts":{"high":1,"all_time":11,"critical":1,"exploited":0,"last_7_days":0,"last_30_days":7,"last_90_days":8,"last_365_days":11},"latest":[{"slug":"rustsec-2026-0440-astral-tokio-tar-is-unmaintained-9bf9b77f","title":"Astral astral-tokio-tar library unmaintained","severity":"info","exploited":false,"published_at":"2026-11-03T12:00:00+00:00","url":"https://junglewise.ai/threats/rustsec-2026-0440-astral-tokio-tar-is-unmaintained-9bf9b77f"},{"cvss":5.3,"slug":"duplicate-advisory-uv-vulnerable-to-arbitrary-file-deletion-through-b611c497","title":"Astral uv arbitrary file deletion through RECORD entries","severity":"medium","exploited":false,"published_at":"2026-10-21T03:32:27+00:00","url":"https://junglewise.ai/threats/duplicate-advisory-uv-vulnerable-to-arbitrary-file-deletion-through-b611c497"},{"cve":"CVE-2026-114110","cvss":5.3,"slug":"cve-2026-114110-astral-uv-before-0-11-6-contains-a-path-traversal-vulnerability","title":"Astral uv path traversal via RECORD entries","severity":"medium","exploited":false,"published_at":"2026-10-21T01:17:37.103+00:00","url":"https://junglewise.ai/threats/cve-2026-114110-astral-uv-before-0-11-6-contains-a-path-traversal-vulnerability"},{"cve":"CVE-2026-114109","cvss":8.8,"slug":"cve-2026-114109-uv-before-0-11-15-contains-a-path-traversal-vulnerability-that","title":"Astral uv path traversal via entry point names","severity":"high","exploited":false,"published_at":"2026-10-21T01:17:36.957+00:00","url":"https://junglewise.ai/threats/cve-2026-114109-uv-before-0-11-15-contains-a-path-traversal-vulnerability-that"},{"cve":"CVE-2025-71437","cvss":6.5,"slug":"cve-2025-71437-astral-uv-before-0-8-22-contains-a-path-traversal-vulnerability","title":"Astral uv path traversal in sdist tar extraction","severity":"medium","exploited":false,"published_at":"2026-10-21T01:17:19.493+00:00","url":"https://junglewise.ai/threats/cve-2025-71437-astral-uv-before-0-8-22-contains-a-path-traversal-vulnerability"},{"cvss":4,"slug":"pysec-2026-4321-uv-s-bundled-ca-store-trusts-an-emsign-root-whose-aeefabb5","title":"Astral uv compromised emSign CA root certificate","severity":"medium","exploited":false,"published_at":"2026-10-20T21:49:27.535265+00:00","url":"https://junglewise.ai/threats/pysec-2026-4321-uv-s-bundled-ca-store-trusts-an-emsign-root-whose-aeefabb5"},{"cvss":4,"slug":"uv-s-bundled-ca-store-trusts-an-emsign-root-whose-intermediate-ca-keys-38269068","title":"uv bundled CA store trusts compromised emSign root","severity":"critical","exploited":false,"published_at":"2026-10-20T19:37:52+00:00","url":"https://junglewise.ai/threats/uv-s-bundled-ca-store-trusts-an-emsign-root-whose-intermediate-ca-keys-38269068"},{"cve":"CVE-2026-104843","cvss":4,"epss":0.0043,"slug":"cve-2026-104843-uv-is-a-python-package-and-project-manager-written-in-rust-from","title":"uv path traversal in wheel extraction on Windows","severity":"medium","exploited":false,"published_at":"2026-10-02T16:16:46.76+00:00","url":"https://junglewise.ai/threats/cve-2026-104843-uv-is-a-python-package-and-project-manager-written-in-rust-from"},{"cvss":6.9,"slug":"astral-astral-tokio-tar-pax-header-desynchronization-c2fb9068","title":"Astral astral-tokio-tar PAX header desynchronization","severity":"medium","exploited":false,"published_at":"2026-05-29T19:08:23+00:00","url":"https://junglewise.ai/threats/astral-astral-tokio-tar-pax-header-desynchronization-c2fb9068"},{"cvss":2.1,"slug":"astral-uv-arbitrary-file-deletion-via-record-path-traversal-5a8fbf07","title":"Astral uv arbitrary file deletion via RECORD path traversal","severity":"low","exploited":false,"published_at":"2026-04-10T19:39:15+00:00","url":"https://junglewise.ai/threats/astral-uv-arbitrary-file-deletion-via-record-path-traversal-5a8fbf07"},{"cve":"CVE-2025-13327","cvss":6.3,"epss":0.0017,"slug":"cve-2025-13327-uv-allows-zip-payload-obfuscation-through-parsing-differentials","title":"uv has ZIP payload obfuscation through parsing differentials","severity":"medium","exploited":false,"published_at":"2026-02-27T08:17:04.043+00:00","url":"https://junglewise.ai/threats/cve-2025-13327-uv-allows-zip-payload-obfuscation-through-parsing-differentials"}],"vendor":{"hub":true,"name":"Astral","slug":"astral","homepage":"https://astral.sh/","description":"A software company focused on high-performance developer tooling for the Python ecosystem.","url":"https://junglewise.ai/threats/vendors/astral"},"weekly":[{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-28","critical":0,"exploited":0,"vulnerabilities":1},{"week":"2026-10-05","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-12","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-19","critical":1,"exploited":0,"vulnerabilities":6},{"week":"2026-10-26","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-11-02","critical":0,"exploited":0,"vulnerabilities":1},{"week":"2026-11-09","critical":0,"exploited":0,"vulnerabilities":0}],"most_severe":[{"cvss":4,"slug":"uv-s-bundled-ca-store-trusts-an-emsign-root-whose-intermediate-ca-keys-38269068","title":"uv bundled CA store trusts compromised emSign root","severity":"critical","exploited":false,"published_at":"2026-10-20T19:37:52+00:00","url":"https://junglewise.ai/threats/uv-s-bundled-ca-store-trusts-an-emsign-root-whose-intermediate-ca-keys-38269068"},{"cve":"CVE-2026-114109","cvss":8.8,"slug":"cve-2026-114109-uv-before-0-11-15-contains-a-path-traversal-vulnerability-that","title":"Astral uv path traversal via entry point names","severity":"high","exploited":false,"published_at":"2026-10-21T01:17:36.957+00:00","url":"https://junglewise.ai/threats/cve-2026-114109-uv-before-0-11-15-contains-a-path-traversal-vulnerability-that"},{"cvss":6.9,"slug":"astral-astral-tokio-tar-pax-header-desynchronization-c2fb9068","title":"Astral astral-tokio-tar PAX header desynchronization","severity":"medium","exploited":false,"published_at":"2026-05-29T19:08:23+00:00","url":"https://junglewise.ai/threats/astral-astral-tokio-tar-pax-header-desynchronization-c2fb9068"},{"cve":"CVE-2025-71437","cvss":6.5,"slug":"cve-2025-71437-astral-uv-before-0-8-22-contains-a-path-traversal-vulnerability","title":"Astral uv path traversal in sdist tar extraction","severity":"medium","exploited":false,"published_at":"2026-10-21T01:17:19.493+00:00","url":"https://junglewise.ai/threats/cve-2025-71437-astral-uv-before-0-8-22-contains-a-path-traversal-vulnerability"},{"cve":"CVE-2025-13327","cvss":6.3,"epss":0.0017,"slug":"cve-2025-13327-uv-allows-zip-payload-obfuscation-through-parsing-differentials","title":"uv has ZIP payload obfuscation through parsing differentials","severity":"medium","exploited":false,"published_at":"2026-02-27T08:17:04.043+00:00","url":"https://junglewise.ai/threats/cve-2025-13327-uv-allows-zip-payload-obfuscation-through-parsing-differentials"},{"cvss":5.3,"slug":"duplicate-advisory-uv-vulnerable-to-arbitrary-file-deletion-through-b611c497","title":"Astral uv arbitrary file deletion through RECORD entries","severity":"medium","exploited":false,"published_at":"2026-10-21T03:32:27+00:00","url":"https://junglewise.ai/threats/duplicate-advisory-uv-vulnerable-to-arbitrary-file-deletion-through-b611c497"},{"cve":"CVE-2026-114110","cvss":5.3,"slug":"cve-2026-114110-astral-uv-before-0-11-6-contains-a-path-traversal-vulnerability","title":"Astral uv path traversal via RECORD entries","severity":"medium","exploited":false,"published_at":"2026-10-21T01:17:37.103+00:00","url":"https://junglewise.ai/threats/cve-2026-114110-astral-uv-before-0-11-6-contains-a-path-traversal-vulnerability"},{"cve":"CVE-2026-104843","cvss":4,"epss":0.0043,"slug":"cve-2026-104843-uv-is-a-python-package-and-project-manager-written-in-rust-from","title":"uv path traversal in wheel extraction on Windows","severity":"medium","exploited":false,"published_at":"2026-10-02T16:16:46.76+00:00","url":"https://junglewise.ai/threats/cve-2026-104843-uv-is-a-python-package-and-project-manager-written-in-rust-from"},{"cvss":4,"slug":"pysec-2026-4321-uv-s-bundled-ca-store-trusts-an-emsign-root-whose-aeefabb5","title":"Astral uv compromised emSign CA root certificate","severity":"medium","exploited":false,"published_at":"2026-10-20T21:49:27.535265+00:00","url":"https://junglewise.ai/threats/pysec-2026-4321-uv-s-bundled-ca-store-trusts-an-emsign-root-whose-aeefabb5"},{"cvss":2.1,"slug":"astral-uv-arbitrary-file-deletion-via-record-path-traversal-5a8fbf07","title":"Astral uv arbitrary file deletion via RECORD path traversal","severity":"low","exploited":false,"published_at":"2026-04-10T19:39:15+00:00","url":"https://junglewise.ai/threats/astral-uv-arbitrary-file-deletion-via-record-path-traversal-5a8fbf07"}],"generated_at":"2026-11-11T03:07:00.183524+00:00","technologies":[{"name":"Astral Uv","slug":"astral-uv","vulnerabilities":8,"url":"https://junglewise.ai/threats/technologies/astral-uv"}]}