CVE-2025-13327— Uv: uv: specially crafted zip archives lead to arbitrary code execution due to parsing differentials
Quick assessment
Affected
astral-sh uv
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
uv是Astral开源的一个项目管理器。 uv存在安全漏洞，该漏洞源于攻击者可通过特制ZIP存档在软件包解析或安装期间执行恶意代码。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2025-13327
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Uv: uv: specially crafted zip archives lead to arbitrary code execution due to parsing differentials
Source: CVE Program / CVE List V5
Vulnerability Description
A flaw was found in uv. This vulnerability allows an attacker to execute malicious code during package resolution or installation via specially crafted ZIP (Zipped Information Package) archives that exploit parsing differentials, requiring user interaction to install an attacker-controlled package.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
CWE-1286
Source: CVE Program / CVE List V5
Vulnerability Title
uv 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
uv是Astral开源的一个项目管理器。 uv存在安全漏洞，该漏洞源于攻击者可通过特制ZIP存档在软件包解析或安装期间执行恶意代码。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| astral-sh | uv | 0 ~ 0.9.6 | - |
|
| Red Hat | Red Hat AI Inference Server | - |
cpe:/a:redhat:ai_inference_server:3
|
|
| Red Hat | Red Hat AI Inference Server | - |
cpe:/a:redhat:ai_inference_server:3
|
|
| Red Hat | Red Hat AI Inference Server | - |
cpe:/a:redhat:ai_inference_server:3
|
|
| Red Hat | Red Hat AI Inference Server | - |
cpe:/a:redhat:ai_inference_server:3
|
|
| Red Hat | Red Hat AI Inference Server | - |
cpe:/a:redhat:ai_inference_server:3
|
|
| Red Hat | Red Hat AI Inference Server | - |
cpe:/a:redhat:ai_inference_server:3
|
|
| Red Hat | Red Hat AI Inference Server | - |
cpe:/a:redhat:ai_inference_server:3
|
|
| Red Hat | Red Hat OpenShift AI (RHOAI) | - |
cpe:/a:redhat:openshift_ai
|
|
| Red Hat | Red Hat OpenShift AI (RHOAI) | - |
cpe:/a:redhat:openshift_ai
|
|
| Red Hat | Red Hat OpenShift AI (RHOAI) | - |
cpe:/a:redhat:openshift_ai
|
|
| Red Hat | Red Hat OpenShift AI (RHOAI) | - |
cpe:/a:redhat:openshift_ai
|
|
| Red Hat | Red Hat OpenShift AI (RHOAI) | - |
cpe:/a:redhat:openshift_ai
|
|
| Red Hat | Red Hat OpenShift AI (RHOAI) | - |
cpe:/a:redhat:openshift_ai
|
|
| Red Hat | Red Hat OpenShift AI (RHOAI) | - |
cpe:/a:redhat:openshift_ai
|
|
| Red Hat | Red Hat OpenShift AI (RHOAI) | - |
cpe:/a:redhat:openshift_ai
|
|
| Red Hat | Red Hat OpenShift AI (RHOAI) | - |
cpe:/a:redhat:openshift_ai
|
|
| Red Hat | Red Hat OpenShift AI (RHOAI) | - |
cpe:/a:redhat:openshift_ai
|
|
| Red Hat | Red Hat OpenShift AI (RHOAI) | - |
cpe:/a:redhat:openshift_ai
|
|
| Red Hat | Red Hat OpenShift AI (RHOAI) | - |
cpe:/a:redhat:openshift_ai
|
|
| Red Hat | Red Hat OpenShift AI (RHOAI) | - |
cpe:/a:redhat:openshift_ai
|
|
| Red Hat | Red Hat OpenShift AI (RHOAI) | - |
cpe:/a:redhat:openshift_ai
|
|
| Red Hat | Red Hat OpenShift AI (RHOAI) | - |
cpe:/a:redhat:openshift_ai
|
|
| Red Hat | Red Hat OpenShift AI (RHOAI) | - |
cpe:/a:redhat:openshift_ai
|
|
| Red Hat | Red Hat OpenShift AI (RHOAI) | - |
cpe:/a:redhat:openshift_ai
|
|
| Red Hat | Red Hat OpenShift AI (RHOAI) | - |
cpe:/a:redhat:openshift_ai
|
|
| Red Hat | Red Hat OpenShift AI (RHOAI) | - |
cpe:/a:redhat:openshift_ai
|
|
| Red Hat | Red Hat OpenShift AI (RHOAI) | - |
cpe:/a:redhat:openshift_ai
|
|
II. Public POCs for CVE-2025-13327
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-13327
请登录查看更多情报信息。
Vendor Advisories for CVE-2025-13327 (1)
IV. Related Vulnerabilities
Same vendor: astral-sh
-
CVE-2026-104843
uv: Path traversal on Windows through wheel extraction -
CVE-2026-32766
astral-tokio-tar insufficiently validates PAX extensions dur -
CVE-2025-62518
astral-tokio-tar Vulnerable to PAX Header Desynchronization -
CVE-2025-59825
astral-tokio-tar has a path traversal in tar extraction -
CVE-2025-54368
uv is vulnerable to ZIP payload obfuscation through parsing
Same weakness: CWE-1286
-
CVE-2026-100902
Barco ClickShare CX-20 Gen2 Wallpaper Upload wallpaper impro -
CVE-2026-87080
Net::IDN::Punycode::PP versions before 2.590 for Perl decode -
CVE-2026-83611
xmldom: Parser silently accepts a not-well-formed end tag wh -
CVE-2026-0931
Denial-of-service vulnerability in M-Files Server -
CVE-2026-25292
Improper Validation of Syntactic Correctness of Input in Aut
V. Comments for CVE-2025-13327
No comments yet