CVE-2026-104843: Astral-Sh Uv

Medium severity, CVSS 5.9. EPSS: 0.4% chance of exploitation in the next 30 days.

uv is a Python package and project manager written in Rust. From 0.12.7 until 0.12.18, uv wheel extraction on Windows can process a malicious wheel in a way that writes a file outside the installation prefix, including an executable in a directory already present on the user's PATH. Non-Windows hosts are not affected. This issue is fixed in version 0.12.18.

Affected products

• Astral-Sh Uv: from 0.12.7, before 0.12.18 (fixed in 0.12.18)

Published 2026-10-02. Last modified 2026-10-02.