Live › vulnerability › CVE-2026-114109
Go to dashboarduv versions before 0.11.15 let a crafted wheel write files outside its scripts directory through console_scripts or gui_scripts entry point names. An attacker who gets a user to install that wheel can plant or overwrite executables on the PATH, which leads to code execution.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
No product ranges from the sources yet.
uv --version (vulnerable if below 0.11.15)
Upgrade uv to 0.11.15 or later.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
uv before 0.11.15 contains a path traversal vulnerability that allows malicious wheels to write files outside the scripts directory via crafted console_scripts or gui_scripts entry point names. Attackers who induce users to install a malicious wheel can place executables in PATH directories, shadowing or overwriting existing binaries for code execution.
This page as .md · .json · in your agent: get_signal("CVE-2026-114109")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.