Astral uv: Path traversal via symlinks in sdist tar extraction
Summary
uv, the Python package manager from Astral, can write files outside the intended extraction directory when it installs a malicious source distribution (sdist). The flaw is a path traversal caused by a crafted chain of symlinks during tar extraction. An attacker must publish a malicious sdist and get a victim to install it, and wheel installations are not affected. The vendor rates the practical impact as low, because sdists already run arbitrary code during installation by design, although the CVSS 4.0 base score is 8.7.
Affected
- uv 0.8.21 and earlier (vendor range: <= 0.8.21)
Fixed in
- uv 0.8.22 and newer
Workaround
- No workaround other than upgrading.
- Installations that use only wheels are not affected.
Exploitation
- No known exploitation in the wild. CISA SSVC: exploitation none, automatable yes, technical impact partial.
- No public exploit found in the research. Exploit details are not summarised here.
Our recommendation
- Inventory uv versions on workstations, CI runners and build images (uv --version).
- Upgrade to uv 0.8.22 or newer, preferably the current release.
- Install only trusted packages from trusted indexes, and prefer wheels where possible.
- Patch promptly despite the low vendor rating, because the fix is low effort.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-7j9j-68r2-f35q github.com
- VulnCheck advisory: Astral uv through 0.8.21 www.vulncheck.com
- Ubuntu CVE record CVE-2025-71437 ubuntu.com
- OpenCVE CVE-2025-71437 app.opencve.io
- HOL Guard CVE-2025-71437 hol.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 01:13.
Original description (NVD)
Astral uv before 0.8.22 contains a path traversal vulnerability in source distribution (sdist) tar extraction that allows a specially crafted sequence of symlinks to redirect file writes outside the intended extraction prefix. Attackers can publish a malicious sdist that, when installed by a victim, writes arbitrary files to filesystem locations outside the installation prefix.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.