CVE-2025-71437 in astral-sh
Summary
by MITRE • 10/22/2026
Astral uv before 0.8.22 contains a path traversal vulnerability in source distribution (sdist) tar extraction that allows a specially crafted sequence of symlinks to redirect file writes outside the intended extraction prefix. Attackers can publish a malicious sdist that, when installed by a victim, writes arbitrary files to filesystem locations outside the installation prefix.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/22/2026
The vulnerability identified in Astral uv prior to version 0.8.22 represents a critical security flaw within the package management ecosystem, specifically affecting the handling of source distribution archives known as sdists. This issue stems from an insufficient validation mechanism during the extraction process of tar files that contain symbolic links. In standard Unix-like operating systems, symlinks are references to other file paths rather than direct data containers. When a package manager extracts these archives, it must strictly enforce boundaries to ensure that any path resolution does not escape the designated installation directory or prefix. The flaw in uv allows an attacker to craft a malicious sdist containing a carefully constructed sequence of symbolic links that resolve to absolute paths or relative paths pointing outside the intended extraction root. This technique exploits the way archive extraction tools follow link references, effectively bypassing chroot-like restrictions or simple path-prefix checks if they are not implemented with rigorous canonicalization and validation logic.
From a technical perspective, this vulnerability is classified under CWE-22: Improper Limitation of a Pathname to a Restricted Directory, which falls within the broader category of CWE-78: Improper Neutralization of Special Elements used in an OS Command (OS Command Injection) when considering the potential for arbitrary file writes. The attack vector relies on the trust placed in package sources by developers and CI/CD pipelines. When uv processes a malicious sdist, it fails to adequately sanitize or validate the target paths resolved through symlink traversal before writing files. This allows the extraction process to write data to arbitrary locations on the host filesystem where uv is executed. The severity of this flaw is amplified because sdists are often downloaded from public registries and installed automatically during development workflows, creating a high-risk surface area for supply chain attacks.
The operational impact of this vulnerability extends beyond simple file overwrites within the project directory. An attacker who publishes such a malicious package can achieve arbitrary write access to sensitive system files, configuration directories, or other user-owned data depending on the privileges under which uv is running. If executed with elevated permissions, this could lead to full system compromise by replacing critical binaries, injecting malicious code into startup scripts, or modifying security configurations. Even in non-privileged contexts, it can disrupt development environments by corrupting project files, stealing sensitive credentials stored in local configuration files, or establishing persistence mechanisms through hidden files in user directories. This undermines the integrity of the software supply chain and erodes trust in automated package installation processes.
To mitigate this risk, organizations must immediately upgrade Astral uv to version 0.8.22 or later, where the extraction logic has been hardened to prevent symlink-based path traversal attacks. During the transition period, it is advisable to audit installed packages for any known malicious sdists and restrict the sources from which packages are downloaded by using trusted registries only. Additionally, running package installation commands with minimal necessary privileges can reduce the blast radius of such an attack. Security teams should also monitor ATT&CK technique T1506: Post-Compromise Discovery or related supply chain compromise tactics to detect any anomalous file system changes resulting from previous installations before the patch was applied. Regularly updating dependency management tools and validating package integrity through checksums are essential practices to maintain a secure development environment against evolving supply chain threats.