---
id: "CVE-2025-13327"
kind: "vulnerability"
aliases: ["CVE-2025-13327", "GHSA-v653-r55g-hcmg"]
title: "uv has ZIP payload obfuscation through parsing differentials"
severity: "medium"
cvss: 6.3
epss: 0.00171
exploited: false
status: "open"
category: "package"
products: [{"name": "uv", "fixed": ["0.9.6"], "affected": "< 0.9.6", "ecosystem": "cargo"}, {"name": "astral uv", "fixed": ["0.9.6"], "affected": "< 0.9.6", "ecosystem": "vendor"}]
ecosystems: ["cargo", "vendor"]
tags: ["ci", "cwe-1286", "package", "python", "uv"]
not_affected_if: ["trusted-pinned-packages", "uv-not-used"]
published_at: "2026-02-27T08:17:04+00:00"
first_seen_at: "2026-10-30T00:35:24+00:00"
updated_at: "2026-10-30T00:57:49+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-v653-r55g-hcmg", "first_seen_at": "2026-10-30T00:35:24+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13327", "first_seen_at": "2026-10-30T00:57:49+00:00"}]
---

# uv has ZIP payload obfuscation through parsing differentials

uv, the Python package manager, can be fooled by specially crafted ZIP archives that parse differently in different tools, so a malicious package hides code from inspection. An attacker gets code execution on the machine when a user installs or resolves that package.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- cargo:uv affected < 0.9.6 fixed 0.9.6
- vendor:astral uv affected < 0.9.6 fixed 0.9.6

## How to check

- Run `uv --version` and compare against the fixed version below.
- Check the lockfile or CI logs for `uv` runs that install packages from unfamiliar or untrusted indexes.

## Fix

- `uv` upgrade to `0.9.6` or later

## Timeline

- 2026-10-30T00:35:24+00:00 ghsa https://github.com/advisories/GHSA-v653-r55g-hcmg
- 2026-10-30T00:57:49+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2025-13327

## Documents

- [advisory] Maintainer's advisory: github.com https://github.com/astral-sh/uv/security/advisories/GHSA-pqhf-p39g-3x64
- [advisory] Third-party advisory: access.redhat.com https://access.redhat.com/security/cve/CVE-2025-13327
- [fix] Patch: github.com https://github.com/astral-sh/uv/commit/da659fee4898a73dbc75070f3e82d49f745e4628

## From the sources

A flaw was found in uv. This vulnerability allows an attacker to execute malicious code during package resolution or installation via specially crafted ZIP (Zipped Information Package) archives that exploit parsing differentials, requiring user interaction to install an attacker-controlled package.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_