CVE-2025-13327 | BDVDB-2026-317618 Detail
astral-shuv
Description#
A flaw was found in uv. This vulnerability allows an attacker to execute malicious code during package resolution or installation via specially crafted ZIP (Zipped Information Package) archives that exploit parsing differentials, requiring user interaction to install an attacker-controlled package.
Impact#
Per CVSS v3.1: confidentiality impact high, integrity impact high, availability impact high. Attack vector: local.
Weaknesses#
- CWE-1286 Improper Validation of Syntactic Correctness of Input
References#
- https://access.redhat.com/errata/RHSA-2026:91219
- https://access.redhat.com/errata/RHSA-2026:91232
- https://access.redhat.com/errata/RHSA-2026:91236
- https://access.redhat.com/errata/RHSA-2026:94459
- https://access.redhat.com/errata/RHSA-2026:94476
- https://access.redhat.com/security/cve/CVE-2025-13327
- https://bugzilla.redhat.com/show_bug.cgi?id=2407263
- https://github.com/astral-sh/uv
- https://github.com/astral-sh/uv/commit/da659fee4898a73dbc75070f3e82d49f745e4628
- https://github.com/astral-sh/uv/security/advisories/GHSA-pqhf-p39g-3x64
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.
- Version 2Most recent update recorded in the CVE List.