Skip to content
CVE PROGRAM SOURCE RECORD8.7 High

CVE-2026-114109

uv before 0.11.15 Arbitrary File Write via Entry Point Names

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

uv before 0.11.15 contains a path traversal vulnerability that allows malicious wheels to write files outside the scripts directory via crafted console_scripts or gui_scripts entry point names. Attackers who induce users to install a malicious wheel can place executables in PATH directories, shadowing or overwriting existing binaries for code execution.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

astral-sh uv

Default version status: unaffected

  • 0 to < 0.11.15affected
  • 0.11.15unaffected
pkg:pypi/uv

astral-sh uv

Default version status: unaffected

  • 0 to < 0.11.15affected
  • 0.11.15unaffected
pkg:cargo/uv

References