- Latest release
- 0.13.7 (Nov 3, 2026): no advisory affects it
- Newest unaffected release
- 0.13.7 (Nov 3, 2026), the latest release
- Advisories
- 5 · 2 high, 3 medium
- Weekly downloads
- 36.7M
- Dependents
- 1,265
- Releases
- 331 since 0.0.5 (Feb 15, 2024)
- Registry
- PyPI
- Releases read
- Nov 8, 2026
Version timeline
- CVE-2026-114110Affects 0.0.5 to 0.11.5 (0.11.6 is outside it)
- CVE-2026-114109Affects 0.0.5 to 0.11.14 (0.11.15 is outside it)
- CVE-2026-104843Affects 0.12.7 to 0.12.17 (0.12.18 is outside it)
- CVE-2025-13327Affects 0.0.5 to 0.9.5 (0.9.6 is outside it)
- CVE-2025-54368Affects 0.0.5 to 0.8.5 (0.8.6 is outside it)
Advisories 5
- CVE-2026-114110High 8.7
Astral uv before 0.11.6 Arbitrary File Deletion via Wheel RECORD Entries
Affected: fixed in 0.11.6.
Fixed in 0.11.6 (released Apr 9, 2026, 195 days before disclosure).
The latest release, 0.13.7, is not affected.
- CVE-2026-114109High 8.7
uv before 0.11.15 Arbitrary File Write via Entry Point Names
Affected: fixed in 0.11.15.
Fixed in 0.11.15 (released May 18, 2026, 156 days before disclosure).
The latest release, 0.13.7, is not affected.
- CVE-2026-104843Medium 5.9
uv: Path traversal on Windows through wheel extraction
Affected: from 0.12.7, fixed in 0.12.18.
Fixed in 0.12.18 (released Sep 22, 2026, 10 days before disclosure).
The latest release, 0.13.7, is not affected.
- CVE-2025-13327Medium 6.3
Uv: uv: specially crafted zip archives lead to arbitrary code execution due to parsing differentials
Affected: fixed in 0.9.6.
Fixed in 0.9.6 (released Oct 29, 2025, 121 days before disclosure).
The latest release, 0.13.7, is not affected.
- CVE-2025-54368Medium 6.8
uv is vulnerable to ZIP payload obfuscation through parsing differentials
Affected: fixed in 0.8.6.
Fixed in 0.8.6 (released Aug 7, 2025, 1 day before disclosure).
The latest release, 0.13.7, is not affected.