Live › vulnerability › GHSA-hq85-5cpj-mr62
Go to dashboarduv, the Python package manager, ships a bundled list of trusted certificate authorities that still includes an emSign root whose intermediate keys were compromised and revoked. An attacker holding one of those keys can forge TLS certificates for any hostname, which uv will accept, enabling man-in-the-middle interception of its connections.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| uv | pypi | < 0.13.4 | 0.13.4 |
Run uv --version and confirm it is below 0.13.4.
0.13.4 or later, which removes the affected root from its bundled CA storeEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
By default, uv verifies TLS connections against a vendored copy of the webpki-root-certs bundle. Versions before 0.13.4 include the emSign ECC Root CA - G3 root. Eight eMudhra intermediate CA certificates that chain to that root have compromised private keys, and the CA has revoked them.
An attacker with one of the compromised keys can issue certificates that uv accepts for any hostname, and can be used to issue certificates to enable MITM attacks.
uv 0.13.4 removes the root from its vendored bundle, following webpki-root-certs 1.0.10. Upgrade to 0.13.4 or later.
This page as .md · .json · in your agent: get_signal("GHSA-hq85-5cpj-mr62")
GitHub Advisory Database, CC-BY 4.0. Posts quoted belong to their authors.