MEDIUM PyPI crates.io
GHSA-4gg8-gxpx-9rph uv is vulnerable to arbitrary file write through entry point names
Modified: 5/29/2026
package
PyPI / uv
pkg:pypi/uv
MEDIUM PyPI
GHSA-8qf3-x8v5-2pj8 · CVE-2025-54368 uv allows ZIP payload obfuscation through parsing differentials
Modified: 8/8/2025
LOW PyPI
GHSA-pjjw-68hj-v9mw uv vulnerable to arbitrary file deletion through RECORD entries
Modified: 4/22/2026
MEDIUM PyPI
GHSA-pqhf-p39g-3x64 · CVE-2025-13327, GHSA-v653-r55g-hcmg uv allows ZIP payload obfuscation through parsing differentials
Modified: 3/4/2026
LOW PyPI
GHSA-w476-p2h3-79g9 uv has differential in tar extraction with PAX headers
Modified: 2/4/2026