Vulnerabilities

Astral uv before 0.11.6 contains a path traversal vulnerability that allows attackers to delete arbitrary files by supplying wheels with relative traversal paths in RECORD entries.

uv before 0.11.15 contains a path traversal vulnerability that allows malicious wheels to write files outside the scripts directory via crafted console_scripts or gui_scripts entry point names.

Astral uv before 0.8.22 contains a path traversal vulnerability in source distribution (sdist) tar extraction that allows a specially crafted sequence of symlinks to redirect file writes outside the intended extraction p…

uv is a Python package and project manager written in Rust.

astral-tokio-tar is a tar archive reading/writing library for async Rust.

astral-tokio-tar is a tar archive reading/writing library for async Rust.

uv is a Python package and project manager written in Rust.