CVE-2026-114109: uv before 0.11.15 Arbitrary File Write via Entry Point Names
uv before 0.11.15 contains a path traversal vulnerability that allows malicious wheels to write files outside the scripts directory via crafted consolescripts or guiscripts entry point names. Attackers who induce users to install a malicious wheel can place executables in PATH directories, shadowing or overwriting existing binaries for code execution.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
uvto a version that resolves this vulnerability.Fixed in 0.11.15
Event History
Frequently Asked Questions
What must an attacker do to exploit this issue?
An attacker must induce a user to install a malicious Python wheel. The wheel must contain crafted console_scripts or gui_scripts entry point names that exploit path traversal during script installation.
Who is exposed?
Users of uv versions earlier than 0.11.15 are exposed when they install malicious wheels. Systems are particularly at risk where the affected script installation process can write into directories included in PATH.
What is the practical impact of a successful exploit?
A malicious wheel can write files outside the intended scripts directory, including executables in PATH directories. This can shadow or overwrite existing binaries and lead to code execution.
What version resolves the issue?
Upgrade uv to version 0.11.15 or later.