CVE-2026-104843: uv: Path traversal on Windows through wheel extraction

Q: Which installations are affected?

Only uv running on Windows is affected. The vulnerable versions are 0.12.7 through versions before 0.12.18; non-Windows hosts are not affected.

Q: What does an attacker need to exploit this issue?

An attacker needs a malicious Python wheel to be processed by uv on Windows. The crafted wheel can cause a file to be written outside the intended installation prefix, including an executable in a directory already on the user's PATH.

Q: Is user interaction required?

Yes. The CVSS vector indicates user interaction is required, meaning a user must initiate processing of the malicious wheel.

Q: What should teams do if they use uv on Windows?

Upgrade uv to version 0.12.18. Until upgraded, avoid installing or processing untrusted wheels with affected Windows versions.

Published Oct 2, 2026

Updated

Impact

In versions of uv from 0.12.7 to 0.12.18 on Windows, uv could be induced into writing a file outside of the installation prefix during wheel installation.

A malicious wheel could use this to place an executable outside of the intended environment, including in a directory already present on the user's PATH.

This vulnerability only affects Windows hosts; no other platforms are affected.

Patches

uv 0.12.18 and newer address this vulnerability. Users are encouraged to upgrade to 0.12.18.

Workarounds

There is no workaround other than upgrading to uv 0.12.18.

Other sources

uv is a Python package and project manager written in Rust. From 0.12.7 until 0.12.18, uv wheel extraction on Windows can process a malicious wheel in a way that writes a file outside the installation prefix, including an executable in a directory already present on the user's PATH. Non-Windows hosts are not affected. This issue is fixed in version 0.12.18.

— NVD

Affected Software

3 affected componentsFixes available

pypi/uv>=0.12.7<0.12.18

rust/uv>=0.12.7<0.12.18

0.12.18

pip/uv>=0.12.7<0.12.18

0.12.18

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade rust/uv to a version that resolves this vulnerability.
Fixed in 0.12.18
Upgrade
Upgrade pip/uv to a version that resolves this vulnerability.
Fixed in 0.12.18
Upgrade
Upgrade uv to a version that resolves this vulnerability.
Fixed in 0.12.18

Event History

Oct 2, 2026

CVE Published

via MITRE·03:29 PM

Data Sourced

via MITRE·03:29 PM

DescriptionWeakness

Data Sourced

via NVD·04:16 PM

DescriptionSeverityWeakness

Oct 5, 2026

Advisory Published

via GitHub·11:42 PM

Data Sourced

via GitHub·11:42 PM

DescriptionWeaknessAffected Software

Frequently Asked Questions

Which installations are affected?

Only uv running on Windows is affected. The vulnerable versions are 0.12.7 through versions before 0.12.18; non-Windows hosts are not affected.

What does an attacker need to exploit this issue?

An attacker needs a malicious Python wheel to be processed by uv on Windows. The crafted wheel can cause a file to be written outside the intended installation prefix, including an executable in a directory already on the user's PATH.

Is user interaction required?

Yes. The CVSS vector indicates user interaction is required, meaning a user must initiate processing of the malicious wheel.

What should teams do if they use uv on Windows?

Upgrade uv to version 0.12.18. Until upgraded, avoid installing or processing untrusted wheels with affected Windows versions.

CVE-2026-104843: uv: Path traversal on Windows through wheel extraction

Other sources

Affected Software

Remediation

Event History

Frequently Asked Questions

Which installations are affected?

What does an attacker need to exploit this issue?

Is user interaction required?

What should teams do if they use uv on Windows?

Company

Resources

Contact