Read the docs
TI-2026-78723 Aliases CVE-2026-114110

Path traversal in Astral uv lets attackers delete arbitrary files

Priority MEDIUM 44CWE-23Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Partial Red Hat: 1 fixed, 2 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-23 and the CVSS impact.

Summary

Astral uv before 0.11.6 contains a path traversal flaw (CWE-23) in how it handles wheel RECORD entries. A remote attacker can craft a malicious wheel whose RECORD entries use relative paths outside the installation prefix. When the user uninstalls that package, uv deletes those files, which can be arbitrary files on the system.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

Description from the CNA

Astral uv before 0.11.6 contains a path traversal vulnerability that allows attackers to delete arbitrary files by supplying wheels with relative traversal paths in RECORD entries. Attackers can craft a malicious wheel whose RECORD references files outside the installation prefix, causing uv to delete those files when the user uninstalls the package.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00348 28th percentileScored 2026-11-07
Fix Partial uv (astral-sh): 0.11.6Red Hat: 3 advisoriesRed Hat: 1 fixed, 2 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
astral-shuvbefore 0.11.60.11.6Patch availableCNA
  • uv Vendorastral-sh Affected before 0.11.6 Fixed in 0.11.6 Patch available CNA

Remediation

Upgrade Astral uv to version 0.11.6 or later. Red Hat fixes this in Red Hat OpenShift AI 3.0 through advisories RHSA-2026:91219, RHSA-2026:91236 and RHSA-2026:94476. Red Hat lists no available fix plan for Red Hat AI Inference Server and Red Hat OpenShift AI (RHOAI).

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

  • Fix · CNA uv (astral-sh) Fixed in 0.11.6

Red Hat 3 advisories

  • RHSA-2026:94476 Released 2026-11-03 · Red Hat rating Critical
    Red Hat AI Base Images 3.0.8 (CUDA)
    • Red Hat OpenShift AI 3.0 registry.redhat.io/rhai/base-image-cuda-rhel9
  • RHSA-2026:91236 Released 2026-10-27 · Red Hat rating Critical
    Red Hat AI Base Images 3.0.7 (CUDA)
    • Red Hat OpenShift AI 3.0 registry.redhat.io/rhai/base-image-cuda-rhel9
  • RHSA-2026:91219 Released 2026-10-27 · Red Hat rating Critical
    Red Hat AI Base Images 3.0.7 (ROCm)
    • Red Hat OpenShift AI 3.0 registry.redhat.io/rhai/base-image-rocm-rhel9

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat AI Inference ServerAffectedNo fix yet: Fix deferred
Red Hat OpenShift AI (RHOAI)AffectedNo fix yet: Fix deferred
Red Hat OpenShift AI 3.0Fixed RHSA-2026:91219, RHSA-2026:91236, RHSA-2026:94476
Not affected: 6 products
  • Lightspeed Core
  • Lightspeed Services for Advanced Cluster Management
  • OpenShift Lightspeed
  • Red Hat AI Inference Server
  • Red Hat Enterprise Linux AI (RHEL AI) 3
  • Red Hat OpenShift AI (RHOAI)

Timeline

  1. 2026-10-21 Threatist record created from CVE-2026-114110
  2. 2026-10-21 CISA SSVC decision points changed
  3. 2026-10-22 Affected versions changed · Red Hat
  4. 2026-10-22 CVSS score added · Red Hat
  5. 2026-10-30 Fix available: RHSA-2026:91219 · Red Hat
  6. 2026-10-30 Fix available: RHSA-2026:91236 · Red Hat
  7. 2026-10-30 Fix available: Red Hat OpenShift AI 3.0 · Red Hat
  8. 2026-11-04 Fix available: RHSA-2026:94476 · Red Hat
  9. 2026-11-04 Affected versions changed · Red Hat

References

Advisory 1

  • TI-2025-38758 astral-tokio-tar Vulnerable to PAX Header Desynchronization CVSS 3.1HIGH 8.1
  • TI-2025-43946 Path traversal in Astral uv sdist extraction allows file writes CVSS 4.0HIGH 8.7
  • TI-2026-78722 Path traversal in uv lets malicious wheels write files CVSS 4.0HIGH 8.7
  • TI-2025-34180 uv is vulnerable to ZIP payload obfuscation through parsing differentials CVSS 4.0MEDIUM 6.8
  • TI-2026-66129 uv: Path traversal on Windows through wheel extraction CVSS 4.0MEDIUM 5.9
  • TI-2025-37264 astral-tokio-tar has a path traversal in tar extraction CVSS 4.0MEDIUM 6.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences