Most recent entries from all

fkie_cve-2026-104843

uv is a Python package and project manager written in Rust. From 0.12.7 until 0.12.18, uv wheel extraction on Windows can process a malicious wheel in a way that writes a file outside the installation prefix, including an executable in a directory already present on the user's PATH. Non-Windows hosts are not affected. This issue is fixed in version 0.12.18.

GHSA-2cv4-cqwr-gwf7 — uv: Path traversal on Windows through wheel extraction

Affected: PyPI: uv, crates.io: uv

### Impact

In versions of uv from 0.12.7 to 0.12.18 on Windows, uv could be induced into writing a file outside of the installation prefix during wheel installation.

A malicious wheel could use this to place an executable outside of the intended environment, including in a directory already present on the user's PATH.

This vulnerability only affects Windows hosts; no other platforms are affected.

### Patches

uv 0.12.18 and newer address this vulnerability. Users are encouraged to upgrade to 0.12.18.

### Workarounds

There is no workaround other than upgrading to uv 0.12.18.

PYSEC-2026-4305 — uv: Path traversal on Windows through wheel extraction

Affected: PyPI: uv

### Impact

In versions of uv from 0.12.7 to 0.12.18 on Windows, uv could be induced into writing a file outside of the installation prefix during wheel installation.

A malicious wheel could use this to place an executable outside of the intended environment, including in a directory already present on the user's PATH.

This vulnerability only affects Windows hosts; no other platforms are affected.

### Patches

uv 0.12.18 and newer address this vulnerability. Users are encouraged to upgrade to 0.12.18.

### Workarounds

There is no workaround other than upgrading to uv 0.12.18.

RHSA-2026:84734 — Red Hat Security Advisory: RHOAI 3.4.5 - Red Hat OpenShift AI

Cohere North AI: Cohere North AI: Arbitrary user information overwrite via incorrect access control Cohere North AI: Cohere North AI: Information disclosure via improper Origin header validation Cohere North AI: Cohere North AI: Information Leak via WebSocket Endpoint urllib3: urllib3 Streaming API improperly handles highly compressed data python-transformers: python-transformers: Arbitrary code execution due to overridden trust_remote_code setting fast-uri: fast-uri: URI authority bypass due to improper delimiter handling undici: undici: Information disclosure and data integrity issues due to incorrect Socks5ProxyAgent connection routing python-pip: Path traversal via malicious entry point name in pip wheel installation allows arbitrary file overwrite urllib3: urllib3: Denial of Service via decompression bomb bypass with Brotli support org.eclipse.parsson/parsson: Eclipse Parsson: Denial of Service via uncontrolled resource consumption in JSON parsing undici: undici: Man-in-the-Middle attack via ignored TLS options with SOCKS5 proxy jetty-security: Eclipse Jetty: Authentication bypass via Digest authentication encoding collision jetty: Eclipse Jetty: Information disclosure due to retained HTTP/1.1 trailers across connections sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer overflow in FTS5 form-data: form-data: Form field override via CRLF injection undici: undici: Denial…

UBUNTU-CVE-2026-104843

Affected: Ubuntu:26.10: uv, Ubuntu:26.10: uv-full