CVE-2026-114109— uv before 0.11.15 Arbitrary File Write via Entry Point Names
Quick assessment
Affected
astral-sh uv
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
uv 0.11.15 之前的版本存在路径遍历漏洞，攻击者可利用精心构造的 或 入口点名称，使恶意的 wheel 包将文件写入 scripts 目录之外。若诱使用户安装此类恶意 wheel，攻击者即可将可执行文件放置于 PATH 目录中，从而遮蔽或覆盖现有二进制文件，实现代码执行。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-114109
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
uv before 0.11.15 Arbitrary File Write via Entry Point Names
Source: CVE Program / CVE List V5
Vulnerability Description
uv before 0.11.15 contains a path traversal vulnerability that allows malicious wheels to write files outside the scripts directory via crafted console_scripts or gui_scripts entry point names. Attackers who induce users to install a malicious wheel can place executables in PATH directories, shadowing or overwriting existing binaries for code execution.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-114109
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-114109
请登录查看更多情报信息。
Other References for CVE-2026-114109 (2)
Same Patch Batch · astral-sh · 2026-10-21 · 3 CVEs total
| CVE-2025-71437 | 6.5 MEDIUM | Astral uv through 0.8.21 Path Traversal via Symlinks in Sdist Tar Extraction |
| CVE-2026-114110 | 5.3 MEDIUM | Astral uv before 0.11.6 Arbitrary File Deletion via Wheel RECORD Entries |
IV. Related Vulnerabilities
Same product: uv
-
CVE-2026-114110
Astral uv before 0.11.6 Arbitrary File Deletion via Wheel RE -
CVE-2025-71437
Astral uv through 0.8.21 Path Traversal via Symlinks in Sdis -
CVE-2026-104843
uv: Path traversal on Windows through wheel extraction -
CVE-2025-13327
Uv: uv: specially crafted zip archives lead to arbitrary cod -
CVE-2025-54368
uv is vulnerable to ZIP payload obfuscation through parsing
Same vendor: astral-sh
-
CVE-2026-114110
Astral uv before 0.11.6 Arbitrary File Deletion via Wheel RE -
CVE-2025-71437
Astral uv through 0.8.21 Path Traversal via Symlinks in Sdis -
CVE-2026-104843
uv: Path traversal on Windows through wheel extraction -
CVE-2026-32766
astral-tokio-tar insufficiently validates PAX extensions dur -
CVE-2025-13327
Uv: uv: specially crafted zip archives lead to arbitrary cod
Same weakness: CWE-22
-
CVE-2026-114040
DT42 BerryNet Model Package Metadata dlmodelmgr.py DLModelMa -
CVE-2026-113743
Tenstorrent tt-metal load_checkpoints.py load_hf_state_dict_ -
CVE-2026-114106
HKUDS Vibe-Trading 0.1.0 before 0.1.7 Path Traversal via rea -
CVE-2026-114098
Dulwich 0.22.5 before 1.2.8 Path Traversal via Stash Pop Sym -
CVE-2026-114097
Dulwich 0.23.1 before 1.2.8 Symlink Path Traversal via filte
V. Comments for CVE-2026-114109
No comments yet