CVE-2026-114110

EUVD-2026-106913
Astral uv before 0.11.6 contains a path traversal vulnerability that allows attackers to delete arbitrary files by supplying wheels with relative traversal paths in RECORD entries. Attackers can craft a malicious wheel whose RECORD references files outside the installation prefix, causing uv to delete those files when the user uninstalls the package.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
5.3 MEDIUM
NETWORK
HIGH
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 18.45%
Common Weakness Enumeration
References
https://github.com/astral-sh/uv/security/advisories/GHSA-pjjw-68hj-v9mw
https://www.vulncheck.com/advisories/astral-uv-before-0.11.6-arbitrary-file-deletion-via-wheel-record-entries