Skip to main content
cve.nowby Sazabi
← crates.io
crates.ioPackage

uv

3 known vulnerabilities (1 high, 2 medium), with the versions each affects and the releases that fix them.

Latest release
0.13.7 (Nov 3, 2026): no advisory affects it
Newest unaffected release
0.13.7 (Nov 3, 2026), the latest release
Advisories
3 · 1 high, 2 medium
Weekly downloads
1,078
Dependents
0
Releases
96 since 0.0.0 (May 8, 2025)
Registry
crates.io
Releases read
Nov 8, 2026

Version timeline

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 3

  • uv before 0.11.15 Arbitrary File Write via Entry Point Names

    Affected: fixed in 0.11.15.

    Fixed in 0.11.15 (released May 18, 2026, 156 days before disclosure).

    The latest release, 0.13.7, is not affected.

  • CVE-2026-104843Medium 5.9

    uv: Path traversal on Windows through wheel extraction

    Affected: from 0.12.7, fixed in 0.12.18.

    Fixed in 0.12.18 (released Sep 22, 2026, 10 days before disclosure).

    The latest release, 0.13.7, is not affected.

  • CVE-2025-13327Medium 6.3

    Uv: uv: specially crafted zip archives lead to arbitrary code execution due to parsing differentials

    Affected: fixed in 0.9.6.

    Fixed in 0.9.11 (released Nov 21, 2025, 98 days before disclosure, the advisory names 0.9.6, which was never published).

    The latest release, 0.13.7, is not affected.