CVEvulnerability

CVE-2025-13327

6.3 MEDIUM Published 2026-02-27 Modified 2026-06-17 Official page ↗
Status
Analyzed
Published
2026-02-27
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
6.3 MEDIUM — CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H
CVSS 3.1 ([email protected])
6.3 MEDIUM — CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-1286

Description

A flaw was found in uv. This vulnerability allows an attacker to execute malicious code during package resolution or installation via specially crafted ZIP (Zipped Information Package) archives that exploit parsing differentials, requiring user interaction to install an attacker-controlled package.

Affected configurations

• astral uv (< 0.9.6)

Related

Weakness · CWE (1)

  • CWE-1286 Improper Validation of Syntactic Correctness of Input weakness

References