CVE-2025-71437
Astral uv before 0.8.22 contains a path traversal vulnerability in source distribution (sdist) tar…
- Risk score
- 43/100
- CVSS
- 6.5 v3.1
- Exploit chance (30 days)
- 0.3%
- Published
- 21 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Astral uv before 0.8.22 contains a path traversal vulnerability in source distribution (sdist) tar extraction that allows a specially crafted sequence of symlinks to redirect file writes outside the intended extraction prefix. Attackers can publish a malicious sdist that, when installed by a victim, writes arbitrary f…
- Affected
- See advisory
- Fix
- Upgrade the product to 0.8.22 or later.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 6.5 medium
References
Original description
Astral uv before 0.8.22 contains a path traversal vulnerability in source distribution (sdist) tar extraction that allows a specially crafted sequence of symlinks to redirect file writes outside the intended extraction prefix. Attackers can publish a malicious sdist that, when installed by a victim, writes arbitrary files to filesystem locations outside the installation prefix.
Last activity 21 Oct 2026. Patch Forecast updates every hour.