{"id":"CVE-2026-104843","aliases":["GHSA-2cv4-cqwr-gwf7","PYSEC-2026-4305"],"url":"https://o3.security/vulnerability/CVE-2026-104843","summary":"uv: Path traversal on Windows through wheel extraction","details":"### Impact\n\nIn versions of uv from 0.12.7 to 0.12.18 on Windows, uv could be induced into writing a file outside of the installation prefix during wheel installation.\n\nA malicious wheel could use this to place an executable outside of the intended environment, including in a directory already present on the user's PATH. \n\nThis vulnerability only affects Windows hosts; no other platforms are affected.\n\n### Patches\n\nuv 0.12.18 and newer address this vulnerability. Users are encouraged to upgrade to 0.12.18.\n\n### Workarounds\n\nThere is no workaround other than upgrading to uv 0.12.18.","published":"2026-10-02T15:29:15.517Z","modified":"2026-10-21T02:54:32.269843325Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"crates.io","name":"uv","fixedVersion":"0.12.18"},{"ecosystem":"PyPI","name":"uv","fixedVersion":"0.12.18"}],"fix":{"url":"https://github.com/astral-sh/uv/commit/67169645278ce082638d619beefa6d062540843b","label":"astral-sh/uv@6716964"},"references":[{"type":"WEB","url":"https://github.com/astral-sh/uv/releases/tag/0.12.18"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/104xxx/CVE-2026-104843.json"},{"type":"ADVISORY","url":"https://github.com/astral-sh/uv/security/advisories/GHSA-2cv4-cqwr-gwf7"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104843"},{"type":"FIX","url":"https://github.com/astral-sh/uv/commit/67169645278ce082638d619beefa6d062540843b"},{"type":"FIX","url":"https://github.com/astral-sh/uv/pull/21923"},{"type":"PACKAGE","url":"https://github.com/astral-sh/uv"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-21T02:54:32.269843325Z"}}