Astral-sh vulnerabilities

Products

• Uv 6
• Tokio-tar 3

Newest

• astral-sh uv Astral uv through 0.8.21 Path Traversal via Symlinks in Sdist Tar Extraction CVE-2025-71437 8.7 HighOctober 21, 2026
• astral-sh uv uv: Path traversal on Windows through wheel extraction CVE-2026-104843 Fix available 5.9 MediumOctober 2, 2026
• astral-sh uv uv before 0.11.15 Arbitrary File Write via Entry Point Names CVE-2026-114109 Fix available 8.7 HighMay 29, 2026
• astral-sh uv Astral uv before 0.11.6 Arbitrary File Deletion via Wheel RECORD Entries CVE-2026-114110 Fix available 8.7 HighApril 10, 2026
• astral astral-tokio-tar, astral-sh tokio-tar +1 more astral-tokio-tar insufficiently validates PAX extensions during extraction CVE-2026-32766 Fix available 1.7 LowMarch 17, 2026
• astral uv, red hat ai inference server, openshift ai (rhoai) +1 more +3 more Uv: uv: specially crafted zip archives lead to arbitrary code execution due to parsing differentials CVE-2025-13327 Fix available 6.3 MediumOctober 29, 2025
• astral-sh tokio-tar astral-tokio-tar Vulnerable to PAX Header Desynchronization CVE-2025-62518 Public exploitFix available 8.1 HighOctober 21, 2025
• astral-sh tokio-tar astral-tokio-tar has a path traversal in tar extraction CVE-2025-59825 Fix available 6.1 MediumSeptember 23, 2025
• astral-sh uv uv is vulnerable to ZIP payload obfuscation through parsing differentials CVE-2025-54368 Fix available 6.8 MediumAugust 7, 2025