Advisory · CVE-2026-114109
Malicious wheels can use uv entry point names to write executables outside the scripts directory
uv before 0.11.15 has a path traversal flaw that lets malicious wheels write files outside the scripts directory through crafted console_scripts or gui_scripts entry point names, placing executables in PATH directories for code execution. CVSS 3.1 8.8.
- Vendor
- Astral
- Product
- uv
- Identifier / CWE
- CVE-2026-114109
CWE-22 - Action timing
- Immediate
Explain it like I’m five
A rigged Python package can name its launcher with folder steps hidden inside, and uv writes that launcher outside the bin folder, where it can shadow a real command.
- 01Malicious wheel published
An attacker builds a wheel whose console_scripts or gui_scripts entry point name contains path traversal steps.
- 02Victim installs the wheel
A user or CI job installs the malicious wheel with uv.
- 03Entry point name not contained
uv uses the crafted entry point name without keeping the resulting file inside the scripts directory.
- 04Executable placed outside
The install writes an executable into a PATH directory or another location outside the scripts directory.
- 05Shadowed binary runs
Per the advisory record, the placed file can shadow or overwrite existing binaries, giving code execution when it is later invoked.
What happened
The uv project disclosed CVE-2026-114109: uv before 0.11.15 contains a path traversal vulnerability (CWE-22) that allows malicious wheels to write files outside the scripts directory via crafted console_scripts or gui_scripts entry point names. Attackers who induce users to install a malicious wheel can place executables in PATH directories, shadowing or overwriting existing binaries for code execution. The CVSS 3.1 score is 8.8, with network attack vector, low complexity, no privileges, and user interaction required.
Per the affected data in the NVD record, versions before 0.11.15 are affected for both the Python and Cargo distributions and 0.11.15 is listed as unaffected, so upgrading to uv 0.11.15 or later is the stated fix.
What to do
- Inventory uv installations on developer workstations, CI runners, and build images, and note the version of each.
- Upgrade affected installations to uv 0.11.15 or later using the project release guidance.
- Install packages only from indexes and sources you trust while remediation is underway, and pin dependencies in CI so a single new wheel cannot land unreviewed.
- Hunt for executables in PATH and scripts directories that appeared during package installs, and for wheels whose entry point names contain path separators or traversal steps.
- Verify the deployed version after updating, including uv copies bundled in containers and tool images.
Management note
Package installers run everywhere code is built, and they run with the builder permissions. Patch uv across workstations and CI first, and treat any install of an untrusted wheel on an old version as a workstation triage event.