TI-2025-38758 CVE-2025-62518 · GHSA-j5gw-2vrg-8fgx
astral-tokio-tar Vulnerable to PAX Header Desynchronization
Priority HIGH 70
astral-tokio-tar is a tar archive reading/writing library for async Rust.
astral-sh
Records7All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high4CVSS 7.0–8.9
Exploited now
astral-sh records in CISA KEVNo astral-sh vulnerabilities are listed in CISA KEV.
Records
7 records
Priority MEDIUM 44
Astral uv before 0.11.6 contains a path traversal vulnerability that allows attackers to delete arbitrary files by supplying wheels with relative traversal paths in RECORD entries.
Priority MEDIUM 44
Astral uv before 0.8.22 contains a path traversal vulnerability in source distribution (sdist) tar extraction that allows a specially crafted sequence of symlinks to redirect file writes outside the intended extraction p…
Priority MEDIUM 40
uv before 0.11.15 contains a path traversal vulnerability that allows malicious wheels to write files outside the scripts directory via crafted console_scripts or gui_scripts entry point names.
TI-2025-34180 CVE-2025-54368 · GHSA-8qf3-x8v5-2pj8
uv is vulnerable to ZIP payload obfuscation through parsing differentials
Priority LOW 29
uv is a Python package and project manager written in Rust.
TI-2026-66129 CVE-2026-104843 · GHSA-2cv4-cqwr-gwf7
uv: Path traversal on Windows through wheel extraction
Priority LOW 27
uv is a Python package and project manager written in Rust.
TI-2025-37264 CVE-2025-59825 · GHSA-3wgq-wrwc-vqmv
astral-tokio-tar has a path traversal in tar extraction
Priority LOW 27
astral-tokio-tar is a tar archive reading/writing library for async Rust.