uv: Path traversal via crafted entry point names
Summary
uv before 0.11.15, a Python package and project manager, does not restrict where console_scripts and gui_scripts entry points are written when it installs a wheel. A malicious wheel can therefore place an executable outside the environment's scripts directory, including in a directory on the user's PATH. An attacker must induce a user or CI pipeline to install the malicious wheel, after which the executable can shadow or overwrite an existing binary and lead to code execution. The GHSA advisory dates from May 18, 2026; the CVE was published on October 21, 2026.
Affected
- uv versions before 0.11.15 (astral-sh/uv, Python package manager)
- Pinned or transitive uv installs below 0.11.15 are also affected
Fixed in
- uv 0.11.15 and later
Workaround
- None. The vendor states that the only remediation is upgrading to uv 0.11.15.
Exploitation
- No known exploitation at the time of the sources reviewed.
- Not listed as known exploited in the sources reviewed.
- CISA SSVC: exploitation none, not automatable.
- A public proof of concept was not found, but this cannot be ruled out.
Our recommendation
- Upgrade uv to 0.11.15 or later on all developer workstations, CI runners and container images.
- Check lockfiles, requirements and build images for uv versions below 0.11.15, including transitive dev dependencies.
- Install Python packages only from trusted indices and use hash-locked requirements.
- Review recently installed wheels on systems where uv ran before the upgrade.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-4gg8-gxpx-9rph github.com
- VulnCheck advisory: uv before 0.11.15 Arbitrary File Write via Entry Point Names www.vulncheck.com
- OSV: GHSA-4gg8-gxpx-9rph osv.dev
- GitLab Advisory Database: GHSA-4gg8-gxpx-9rph (uv) advisories.gitlab.com
- VulDB entry for CVE-2026-114109 vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 01:07.
Original description (NVD)
uv before 0.11.15 contains a path traversal vulnerability that allows malicious wheels to write files outside the scripts directory via crafted console_scripts or gui_scripts entry point names. Attackers who induce users to install a malicious wheel can place executables in PATH directories, shadowing or overwriting existing binaries for code execution.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.