CVE-2025-54368
BaseFortify
Publication date: 2025-08-08
Last updated on: 2025-08-08
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| astral-sh | uv | 0.8.5 |
| astral-sh | uv | 0.8.6 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-436 | Product A handles inputs or steps differently than Product B, which causes A to perform incorrect actions based on its perception of B's state. |
| CWE-20 | The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the uv Python package and project manager (written in Rust) in versions 0.8.5 and earlier. It involves how remote ZIP archives are processed: the package handles ZIP files in a streamwise manner without reconciling file entries against the archive's central directory. An attacker can craft a ZIP archive that extracts legitimate contents on some package installers but malicious contents on others due to multiple local file entries. Additionally, an attacker can create a "stacked" ZIP input with multiple internal ZIPs, which different installers handle differently. This allows the attacker to target specific installers with malicious content. The issue is fixed in version 0.8.6.
How can this vulnerability impact me? :
This vulnerability can lead to the extraction of malicious files instead of legitimate ones depending on the package installer used. This means an attacker could deliver malicious payloads disguised within ZIP archives, potentially compromising the security of your system or software environment when using vulnerable versions of the uv package.
What immediate steps should I take to mitigate this vulnerability?
Upgrade the uv package to version 0.8.6 or later. As a temporary workaround, you may set the environment variable UV_INSECURE_NO_ZIP_VALIDATION=1 to revert to the previous behavior, but this is not recommended as a permanent fix.