---
id: "GHSA-hq85-5cpj-mr62"
kind: "vulnerability"
aliases: ["GHSA-hq85-5cpj-mr62"]
title: "uv's bundled CA store trusts an emSign root whose intermediate CA keys are compromised"
severity: "critical"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "uv", "fixed": ["0.13.4"], "affected": "< 0.13.4", "ecosystem": "pypi"}]
ecosystems: ["pypi"]
tags: ["ci", "cwe-295", "developer-workstations", "package", "python", "uv"]
not_affected_if: ["system-trust-store-only", "uv-0.13.4-or-later"]
published_at: "2026-10-20T19:37:52+00:00"
first_seen_at: "2026-10-23T19:11:32+00:00"
updated_at: "2026-10-23T20:13:31+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-hq85-5cpj-mr62", "first_seen_at": "2026-10-23T19:11:32+00:00"}]
---

# uv's bundled CA store trusts an emSign root whose intermediate CA keys are compromised

uv, the Python package manager, ships a bundled list of trusted certificate authorities that still includes an emSign root whose intermediate keys were compromised and revoked. An attacker holding one of those keys can forge TLS certificates for any hostname, which uv will accept, enabling man-in-the-middle interception of its connections.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- pypi:uv affected < 0.13.4 fixed 0.13.4

## How to check

Run `uv --version` and confirm it is below 0.13.4.

## Fix

Upgrade uv to 0.13.4 or later, which removes the affected root from its bundled CA store.
If uv cannot be upgraded, pin or use a system trust store instead of the bundled one (exact setting unknown from sources).

## Timeline

- 2026-10-23T19:11:32+00:00 ghsa https://github.com/advisories/GHSA-hq85-5cpj-mr62

## From the sources

By default, uv verifies TLS connections against a vendored copy of the `webpki-root-certs` bundle. Versions before 0.13.4 include the `emSign ECC Root CA - G3` root. Eight eMudhra intermediate CA certificates that chain to that root have compromised private keys, and the CA has revoked them.

An attacker with one of the compromised keys can issue certificates that uv accepts for any hostname, and can be used to issue certificates to enable MITM attacks.

uv 0.13.4 removes the root from its vendored bundle, following `webpki-root-certs` 1.0.10. Upgrade to 0.13.4 or later.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_