medium5.3
CVE-2026-114110
Astral uv before 0.11.6 contains a path traversal vulnerability that allows attackers to delete arbitrary files by supplying wheels with relative traversal pat…
Impact
Astral uv before 0.11.6 contains a path traversal vulnerability that allows attackers to delete arbitrary files by supplying wheels with relative traversal paths in RECORD entries. Attackers can craft a malicious wheel whose RECORD references files outside the installation prefix, causing uv to delete those files when the user uninstalls the package.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| pip | uv | <= 0.11.5 | 0.11.6 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/advisories/GHSA-pjjw-68hj-v9mw
- https://github.com/astral-sh/uv/security/advisories/GHSA-pjjw-68hj-v9mw
- https://github.com/astral-sh/uv/pull/18942
- https://github.com/astral-sh/uv/pull/18943
- https://github.com/astral-sh/uv/commit/7983c7a5bef236fd8a04580fcedae7bd5bde4cdb
- https://github.com/astral-sh/uv/commit/a0e461ac44851f9a0f6e8974733e77d46f7a9ea9
- https://github.com/astral-sh/uv/releases/tag/0.11.6
- https://nvd.nist.gov/vuln/detail/CVE-2026-114110
- https://www.vulncheck.com/advisories/astral-uv-before-0.11.6-arbitrary-file-deletion-via-wheel-record-entries