Vulnerability advisory

GHSA-2cv4-cqwr-gwf7

uv: Path traversal on Windows through wheel extraction

Published Oct 5, 2026Updated Oct 15, 2026OSV record ↗

Also known as CVE-2026-104843PYSEC-2026-4305

Severity

CVSS 4.0CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Affected versions

uv PyPI

All uv advisories →

Affected	Fixed in
`0.12.7` to before 0.12.18	`0.12.18`Advisories →
Also listed as affected (11) `0.12.10` `0.12.11` `0.12.12` `0.12.13` `0.12.14` `0.12.15` `0.12.16` `0.12.17` `0.12.7` `0.12.8` `0.12.9`

uv crates.io

All uv advisories →

Affected	Fixed in
`0.12.7` to before 0.12.18	`0.12.18`Advisories →

Description

Impact

In versions of uv from 0.12.7 to 0.12.18 on Windows, uv could be induced into writing a file outside of the installation prefix during wheel installation.

A malicious wheel could use this to place an executable outside of the intended environment, including in a directory already present on the user's PATH.

This vulnerability only affects Windows hosts; no other platforms are affected.

Patches

uv 0.12.18 and newer address this vulnerability. Users are encouraged to upgrade to 0.12.18.

Workarounds

There is no workaround other than upgrading to uv 0.12.18.