Directory Traversal Vulnerability in uv Python Package by Astral-sh

CVE-2026-104843

What is CVE-2026-104843?

The uv package, a project manager written in Rust for Python, is susceptible to a directory traversal vulnerability on Windows systems. This flaw allows attackers to exploit the wheel extraction process, potentially writing files outside the designated installation directory, including executable files in folders that are already included in the user's system PATH. This could result in unauthorized code execution or other malicious activities. The issue affects versions ranging from 0.12.7 to 0.12.17 and has been resolved in version 0.12.18, which users are encouraged to upgrade to for improved security.

References