Live › vulnerability › GHSA-m3wx-qqmx-qxvf
Go to dashboardThis advisory is withdrawn as a duplicate of GHSA-pjjw-68hj-v9mw, which covers the same uv flaw. The original text says uv before 0.11.6 follows relative traversal paths in a wheel's RECORD file, so a malicious wheel can make uv delete files outside the install location when the package is uninstalled.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 20:59 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|
| uv | pypi | < 0.11.6 | – |
Run uv --version and check whether it reports a version below 0.11.6.
0.11.6 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
This advisory has been withdrawn because it is a duplicate of GHSA-pjjw-68hj-v9mw. This link is maintained to preserve external references.
Astral uv before 0.11.6 contains a path traversal vulnerability that allows attackers to delete arbitrary files by supplying wheels with relative traversal paths in RECORD entries. Attackers can craft a malicious wheel whose RECORD references files outside the installation prefix, causing uv to delete those files when the user uninstalls the package.
This page as .md · .json · in your agent: get_signal("GHSA-m3wx-qqmx-qxvf")
GitHub Advisory Database, CC-BY 4.0. Posts quoted belong to their authors.