{"id":"UBUNTU-CVE-2026-104843","details":"uv is a Python package and project manager written in Rust. From 0.12.7 until 0.12.18, uv wheel extraction on Windows can process a malicious wheel in a way that writes a file outside the installation prefix, including an executable in a directory already present on the user's PATH. Non-Windows hosts are not affected. This issue is fixed in version 0.12.18.","modified":"2026-10-17T12:58:42.977080784Z","published":"2026-10-02T16:16:00Z","upstream":["CVE-2026-104843"],"references":[{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2026-104843"},{"type":"REPORT","url":"https://www.cve.org/CVERecord?id=CVE-2026-104843"},{"type":"REPORT","url":"https://github.com/astral-sh/uv/security/advisories/GHSA-2cv4-cqwr-gwf7"},{"type":"REPORT","url":"https://github.com/astral-sh/uv/commit/67169645278ce082638d619beefa6d062540843b"},{"type":"REPORT","url":"https://github.com/astral-sh/uv/pull/21923"},{"type":"REPORT","url":"https://github.com/astral-sh/uv/releases/tag/0.12.18"}],"affected":[{"package":{"name":"uv","ecosystem":"Ubuntu:26.10","purl":"pkg:deb/ubuntu/uv?arch=source&distro=stonking"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.17+ds1-3","0.9.17+ds1-4","0.9.17+ds1-5","0.9.17+ds1-6"],"ecosystem_specific":{"binaries":[{"binary_name":"python3-uv-build","binary_version":"0.9.17+ds1-6"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-104843.json"}},{"package":{"name":"uv-full","ecosystem":"Ubuntu:26.10","purl":"pkg:deb/ubuntu/uv-full?arch=source&distro=stonking"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.11.20+ds-0ubuntu1"],"ecosystem_specific":{"binaries":[{"binary_name":"uv","binary_version":"0.11.20+ds-0ubuntu1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-104843.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N"},{"type":"Ubuntu","score":"medium"}]}