CVE-2026-104843 in astral-sh
Summary
by MITRE • 10/02/2026
uv is a Python package and project manager written in Rust. From 0.12.7 until 0.12.18, uv wheel extraction on Windows can process a malicious wheel in a way that writes a file outside the installation prefix, including an executable in a directory already present on the user's PATH. Non-Windows hosts are not affected. This issue is fixed in version 0.12.18.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/02/2026
The vulnerability identified within the uv Python package and project manager represents a critical path traversal flaw specific to Windows environments, arising from improper validation of file paths during wheel extraction operations. The tool, which is implemented in Rust for performance benefits, failed to adequately sanitize or validate archive entries when processing .whl files on Microsoft operating systems between versions 0.12.7 and 0.12.18. This deficiency allows an attacker who can supply a maliciously crafted wheel file to manipulate the extraction process such that files are written outside of the intended installation prefix directory. The core technical flaw lies in the handling of relative paths or symbolic links within the archive structure, where the application does not strictly enforce boundary constraints before writing data to the local filesystem.
The operational impact of this vulnerability is severe due to its potential for arbitrary code execution and privilege escalation on affected systems. By exploiting the path traversal issue, an attacker can force uv to write executable files into directories that are already present in the system PATH environment variable. This capability effectively bypasses standard installation sandboxing mechanisms because any script or binary placed in a PATH directory will be executed automatically by subsequent commands run by the user or automated build processes. Consequently, this enables remote code execution if an attacker can trick a developer or CI/CD pipeline into installing a malicious package from a compromised registry or supply chain vector.
This vulnerability aligns with CWE-22: Improper Limitation of a Pathname to a Restricted Directory and is closely related to CWE-94: Code Injection, as it facilitates the execution of untrusted code through file system manipulation. In terms of MITRE ATT&CK mapping, this behavior corresponds to T1059 Command and Scripting Interpreter for executing injected payloads and potentially T1204 User Execution if social engineering is used to induce a user to install the malicious wheel. The attack vector primarily involves supply chain compromise or phishing scenarios where a victim installs a seemingly legitimate but maliciously packaged Python library that contains crafted archive entries designed to exploit this specific extraction logic error.
Mitigation strategies require immediate upgrading of uv to version 0.12.18 or later, which includes the necessary patches to enforce strict path validation during wheel extraction on Windows platforms. Organizations should also implement supply chain security controls such as verifying package integrity via checksums and signatures before installation. Additionally, developers can mitigate risk by using virtual environments with restricted PATH variables and employing static analysis tools that flag suspicious archive structures in dependencies. Continuous monitoring of installed packages for unexpected file system changes is recommended to detect potential exploitation attempts early.