{"id":"CVE-2026-114109","aliases":["GHSA-4gg8-gxpx-9rph"],"url":"https://o3.security/vulnerability/CVE-2026-114109","summary":"uv before 0.11.15 Arbitrary File Write via Entry Point Names","details":"### Impact\n\nIn versions of uv prior to 0.11.15, when installing a distribution containing an entry point specification (under `console_scripts` or `gui_scripts`), uv would place the generated entry point according to the given name even if doing so resulted in a path outside of the environment's scripts directory.\n\nA malicious wheel could use this to place an executable outside of the intended environment, including in a directory already present on the user's `PATH`. This could shadow or overwrite an existing executable and potentially result in unexpected code execution under the wheel's control, even if the wheel's installation environment was not explicitly added to `PATH` by the user.\n\nIn order to exploit this vulnerability, the attacker must induce their target into installing a malicious wheel.\n\n### Patches\n\nuv 0.11.15 and newer address this vulnerability. Users are encouraged to upgrade to 0.11.15.\n\n### Workarounds\n\nThere is no workaround other than upgrading to uv 0.11.15.","published":"2026-10-21T00:37:08.897Z","modified":"2026-10-24T02:50:19.784630732Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"crates.io","name":"uv","fixedVersion":"0.11.15"},{"ecosystem":"PyPI","name":"uv","fixedVersion":"0.11.15"}],"fix":null,"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/114xxx/CVE-2026-114109.json"},{"type":"ADVISORY","url":"https://github.com/astral-sh/uv/security/advisories/GHSA-4gg8-gxpx-9rph"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114109"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/uv-before-0.11.15-arbitrary-file-write-via-entry-point-names"},{"type":"PACKAGE","url":"https://github.com/astral-sh/uv"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-24T02:50:19.784630732Z"}}