GHSA-2cv4-cqwr-gwf7: Path Traversal

Q: Which systems and deployments are exposed?

Only Windows hosts using uv versions 0.12.7 through 0.12.18 are affected. Hosts running other platforms are not affected.

Q: What must an attacker provide to exploit this issue?

An attacker would need to induce uv to install a malicious wheel. The wheel can cause a file to be written outside the intended installation prefix, potentially placing an executable in a directory already on the user's PATH.

Q: Is there a mitigation if upgrading cannot happen immediately?

No. The provided workaround guidance states that upgrading is the only workaround.

Q: What version should be deployed to remediate the issue?

Upgrade uv to version 0.12.18 or newer.

Published Oct 5, 2026

Updated

Impact

In versions of uv from 0.12.7 to 0.12.18 on Windows, uv could be induced into writing a file outside of the installation prefix during wheel installation.

A malicious wheel could use this to place an executable outside of the intended environment, including in a directory already present on the user's PATH.

This vulnerability only affects Windows hosts; no other platforms are affected.

Patches

uv 0.12.18 and newer address this vulnerability. Users are encouraged to upgrade to 0.12.18.

Workarounds

There is no workaround other than upgrading to uv 0.12.18.

Affected Software

2 affected componentsFixes available

rust/uv>=0.12.7<0.12.18

0.12.18

pip/uv>=0.12.7<0.12.18

0.12.18

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade rust/uv to a version that resolves this vulnerability.
Fixed in 0.12.18
Upgrade
Upgrade pip/uv to a version that resolves this vulnerability.
Fixed in 0.12.18
Upgrade
Upgrade uv to a version that resolves this vulnerability.
Fixed in 0.12.18

Event History

Oct 5, 2026

Advisory Published

via GitHub·11:42 PM

Data Sourced

via GitHub·11:42 PM

DescriptionWeaknessAffected Software

Frequently Asked Questions

Which systems and deployments are exposed?

Only Windows hosts using uv versions 0.12.7 through 0.12.18 are affected. Hosts running other platforms are not affected.

What must an attacker provide to exploit this issue?

An attacker would need to induce uv to install a malicious wheel. The wheel can cause a file to be written outside the intended installation prefix, potentially placing an executable in a directory already on the user's PATH.

Is there a mitigation if upgrading cannot happen immediately?

No. The provided workaround guidance states that upgrading is the only workaround.

What version should be deployed to remediate the issue?

Upgrade uv to version 0.12.18 or newer.

GHSA-2cv4-cqwr-gwf7: Path Traversal

Affected Software

Remediation

Event History

Frequently Asked Questions

Which systems and deployments are exposed?

What must an attacker provide to exploit this issue?

Is there a mitigation if upgrading cannot happen immediately?

What version should be deployed to remediate the issue?

Company

Resources

Contact

Frequently Asked Questions

Which systems and deployments are exposed?

What must an attacker provide to exploit this issue?

Is there a mitigation if upgrading cannot happen immediately?

What version should be deployed to remediate the issue?