Astral uv: Arbitrary file deletion via wheel RECORD entries
Summary
Astral uv before 0.11.6 contains a path traversal flaw in how it processes the RECORD file of Python wheels. A malicious wheel can list files outside its installation prefix, and uv deletes those files when the package is uninstalled. The attacker must get a victim to install and then uninstall the crafted package, so the main exposure is developer workstations and CI runners that pull packages from PyPI. Severity scores differ between sources (CVSS 4.0 8.7 in the CVE record, 2.1 in the GitHub advisory, 4.3 under CVSS 3.1 on GitHub), so the rating should be set internally.
Affected
- uv versions before 0.11.6 (GitHub advisory: 0.11.5 and earlier)
Fixed in
- uv 0.11.6 or newer. Upstream fixes are PRs #18942 and #18943.
Workaround
- No vendor workaround other than upgrading.
- A third-party source suggests validating wheel RECORD files before uv processes them. This is generic advice and not tested by the vendor.
Exploitation
- No evidence of exploitation in the wild found in the sources.
- No public proof of concept found in the sources.
- Not listed in CISA KEV according to the sources.
- CISA SSVC: exploitation none, automatable yes, technical impact partial.
Our recommendation
- Inventory uv installations on developer machines, CI runners and container images, and check lock files for versions below 0.11.6.
- Upgrade to at least 0.11.15, which also covers the related CVE-2026-114109. Check PyPI for the latest release before pinning.
- Install packages only from trusted sources and watch for typosquatted or compromised packages.
- Monitor the NVD entry, which was still awaiting analysis in the sources, for re-scoring.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-pjjw-68hj-v9mw github.com
- VulnCheck advisory www.vulncheck.com
- OSV GHSA-pjjw-68hj-v9mw osv.dev
- GitHub Advisory Database GHSA-pjjw-68hj-v9mw github.com
- VulDB CVE-2026-114110 vuldb.com
- Strix CVE-2026-114110 www.strix.ai
- CVE-2026-114110 aggregator entry cve.threatint.com
- GitLab advisory database GHSA-pjjw-68hj-v9mw advisories.gitlab.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 01:06.
Original description (NVD)
Astral uv before 0.11.6 contains a path traversal vulnerability that allows attackers to delete arbitrary files by supplying wheels with relative traversal paths in RECORD entries. Attackers can craft a malicious wheel whose RECORD references files outside the installation prefix, causing uv to delete those files when the user uninstalls the package.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.