CVE-2026-104843: uv: Path traversal on Windows through wheel extraction

Q: Which installations are affected?

Only uv running on Windows is affected. The vulnerable versions are 0.12.7 through versions before 0.12.18; non-Windows hosts are not affected.

Q: What does an attacker need to exploit this issue?

An attacker needs a malicious Python wheel to be processed by uv on Windows. The crafted wheel can cause a file to be written outside the intended installation prefix, including an executable in a directory already on the user's PATH.

Q: Is user interaction required?

Yes. The CVSS vector indicates user interaction is required, meaning a user must initiate processing of the malicious wheel.

Q: What should teams do if they use uv on Windows?

Upgrade uv to version 0.12.18. Until upgraded, avoid installing or processing untrusted wheels with affected Windows versions.

Published Oct 2, 2026

Updated

uv is a Python package and project manager written in Rust. From 0.12.7 until 0.12.18, uv wheel extraction on Windows can process a malicious wheel in a way that writes a file outside the installation prefix, including an executable in a directory already present on the user's PATH. Non-Windows hosts are not affected. This issue is fixed in version 0.12.18.

Affected Software

1 affected component

pypi/uv>=0.12.7<0.12.18

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade uv to a version that resolves this vulnerability.
Fixed in 0.12.18

Event History

Oct 2, 2026

CVE Published

via MITRE·03:29 PM

Data Sourced

via MITRE·03:29 PM

DescriptionWeakness

Data Sourced

via NVD·04:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which installations are affected?

Only uv running on Windows is affected. The vulnerable versions are 0.12.7 through versions before 0.12.18; non-Windows hosts are not affected.

What does an attacker need to exploit this issue?

An attacker needs a malicious Python wheel to be processed by uv on Windows. The crafted wheel can cause a file to be written outside the intended installation prefix, including an executable in a directory already on the user's PATH.

Is user interaction required?

Yes. The CVSS vector indicates user interaction is required, meaning a user must initiate processing of the malicious wheel.

What should teams do if they use uv on Windows?

Upgrade uv to version 0.12.18. Until upgraded, avoid installing or processing untrusted wheels with affected Windows versions.

CVE-2026-104843: uv: Path traversal on Windows through wheel extraction

Affected Software

Remediation

Event History

Frequently Asked Questions

Which installations are affected?

What does an attacker need to exploit this issue?

Is user interaction required?

What should teams do if they use uv on Windows?

Company

Resources

Contact

Frequently Asked Questions

Which installations are affected?

What does an attacker need to exploit this issue?

Is user interaction required?

What should teams do if they use uv on Windows?