{"id":"CVE-2025-13327","kind":"vulnerability","aliases":["CVE-2025-13327","GHSA-v653-r55g-hcmg"],"related":[],"title":"uv has ZIP payload obfuscation through parsing differentials","description":"A flaw was found in uv. This vulnerability allows an attacker to execute malicious code during package resolution or installation via specially crafted ZIP (Zipped Information Package) archives that exploit parsing differentials, requiring user interaction to install an attacker-controlled package.","summary":"uv, the Python package manager, can be fooled by specially crafted ZIP archives that parse differently in different tools, so a malicious package hides code from inspection. An attacker gets code execution on the machine when a user installs or resolves that package.","severity":"medium","cvss":6.3,"epss":0.00171,"exploited":false,"exploited_at":null,"products":[{"name":"uv","fixed":["0.9.6"],"affected":"< 0.9.6","ecosystem":"cargo"},{"name":"astral uv","fixed":["0.9.6"],"affected":"< 0.9.6","ecosystem":"vendor"}],"ecosystems":["cargo","vendor"],"tags":["ci","cwe-1286","package","python","uv"],"not_affected_if":["trusted-pinned-packages","uv-not-used"],"how_to_check":"- Run `uv --version` and compare against the fixed version below.\n- Check the lockfile or CI logs for `uv` runs that install packages from unfamiliar or untrusted indexes.","fix":"- `uv` upgrade to `0.9.6` or later","status":"open","published_at":"2026-02-27T08:17:04+00:00","first_seen_at":"2026-10-30T00:35:24+00:00","triaged_at":"2026-10-30T00:35:28+00:00","updated_at":"2026-10-30T00:57:49+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-30T00:35:28Z","model":"claude-haiku-5-5","output":{"fix":"- `uv` upgrade to `0.9.6` or later","reach":"internet","title":"uv: crafted ZIP archives let a package install run attacker code","impact":"high","summary":"uv, the Python package manager, can be fooled by specially crafted ZIP archives that parse differently in different tools, so a malicious package hides code from inspection. An attacker gets code execution on the machine when a user installs or resolves that package.","audience":"developers","category":"package","nicknames":[],"who_cares":["python","uv","ci"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"code runs on the installing machine via a malicious package","analyst_note":"","how_to_check":"- Run `uv --version` and compare against the fixed version below.\n- Check the lockfile or CI logs for `uv` runs that install packages from unfamiliar or untrusted indexes.","plain_action":"","needs_analyst":false,"not_affected_if":["uv-not-used","trusted-pinned-packages"],"who_is_affected":"Teams and developers who run uv to install or resolve Python packages, including in CI and build pipelines. Systems that never run uv, or only install from a trusted, pinned set of packages, are much less exposed. The sources do not describe further configuration conditions.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"unknown"},"cost_usd":0.000657,"input_tokens":4181,"output_tokens":478,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-1286':25B '-13327':11A,19A '-2025':10A,18A 'allow':80C 'archiv':41B,99C 'astral':21A 'attack':57B,82C,111C 'attacker-control':110C 'ci':23B 'code':53B,59B,86C 'control':112C 'craft':39B,94C 'cve':9A,17A 'cwe':24B 'differ':44B,46B 'differenti':8A,103C 'execut':60B,84C 'exploit':101C 'flaw':73C 'fool':36B 'found':75C 'get':58B 'ghsa':13A 'ghsa-v653-r55g-hcmg':12A 'hcmg':16A 'hide':52B 'inform':97C 'inspect':55B 'instal':67B,91C,108C 'interact':106C 'machin':63B 'malici':50B,85C 'manag':33B 'obfusc':5A 'packag':26B,32B,51B,71B,88C,98C,113C 'pars':7A,43B,102C 'payload':4A 'python':27B,31B 'r55g':15A 'requir':104C 'resolut':89C 'resolv':69B 'special':38B,93C 'tool':47B 'user':66B,105C 'uv':1A,20A,22A,28B,29B,77C 'v653':14A 'via':92C 'vulner':79C 'zip':3A,40B,95C,96C","nicknames":[],"mitigations":[],"who_affected":"Teams and developers who run uv to install or resolve Python packages, including in CI and build pipelines. Systems that never run uv, or only install from a trusted, pinned set of packages, are much less exposed. The sources do not describe further configuration conditions.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"first_public_at":"2026-02-27T08:17:04+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-v653-r55g-hcmg","url":"https://github.com/advisories/GHSA-v653-r55g-hcmg","severity":"medium","published_at":"2026-02-27T09:30:29+00:00","modified_at":"2026-10-30T00:30:32+00:00","first_seen_at":"2026-10-30T00:35:24+00:00","fetched_at":"2026-10-30T02:53:51+00:00","note":null},{"source":"nvd","external_id":"CVE-2025-13327","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-13327","severity":null,"published_at":"2026-02-27T08:17:04+00:00","modified_at":"2026-10-29T23:16:54+00:00","first_seen_at":"2026-10-30T00:57:49+00:00","fetched_at":"2026-10-30T00:57:49+00:00","note":null}],"documents":[{"id":20276,"url":"https://github.com/astral-sh/uv/security/advisories/GHSA-pqhf-p39g-3x64","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"},{"id":20277,"url":"https://github.com/astral-sh/uv/commit/da659fee4898a73dbc75070f3e82d49f745e4628","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":20294,"url":"https://access.redhat.com/security/cve/CVE-2025-13327","title":"Third-party advisory: access.redhat.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: access.redhat.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}