CVE-2026-114109

Deferred Deferred - Pending Action

Path Traversal in uv Python Package

Publication date: 2026-10-21

Last updated on: 2026-10-28

Assigner: VulnCheck

Description

uv before 0.11.15 contains a path traversal vulnerability that allows malicious wheels to write files outside the scripts directory via crafted console_scripts or gui_scripts entry point names. Attackers who induce users to install a malicious wheel can place executables in PATH directories, shadowing or overwriting existing binaries for code execution.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-21

Last Modified

2026-10-28

Generated

2026-11-10

AI Q&A

2026-10-21

EPSS Evaluated

2026-11-08

NVD

CVE-2026-114109

EUVD

EUVD-2026-106912

Affected Vendors & Products

Vendor	Product	Version / Range
astral-sh	uv	0
astral-sh	uv	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

This vulnerability is a path traversal issue in uv before version 0.11.15. It allows malicious Python wheels to write files outside the intended scripts directory by exploiting crafted entry point names like console_scripts or gui_scripts. Attackers can place executables in system PATH directories, potentially overwriting existing binaries for unauthorized code execution.

Detection Guidance

Check the installed version of uv using 'uv --version'. If it is below 0.11.15, the system is vulnerable. Inspect installed wheels for malicious entry points by reviewing package metadata or using 'pip list' to identify suspicious packages.

Impact Analysis

If you install a malicious wheel, an attacker could overwrite system binaries in your PATH, leading to unintended code execution. This could allow them to run arbitrary commands on your system with your privileges, potentially compromising your data or system integrity.

Compliance Impact

This vulnerability primarily enables arbitrary file writes and potential code execution by tricking users into installing malicious wheels. While it does not directly violate GDPR or HIPAA, it could lead to unauthorized data access or system compromise if exploited, which may result in non-compliance with these regulations due to potential data breaches or loss of integrity.

Mitigation Strategies

Upgrade uv to version 0.11.15 or later immediately. Avoid installing untrusted or third-party wheels. Remove any suspicious executables from PATH directories and audit installed packages for signs of compromise.

Hi! I’m here to help you understand CVE-2026-114109. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...