Description (CNA)
Astral uv before 0.8.22 contains a path traversal vulnerability in source distribution (sdist) tar extraction that allows a specially crafted sequence of symlinks to redirect file writes outside the intended extraction prefix. Attackers can publish a malicious sdist that, when installed by a victim, writes arbitrary files to filesystem locations outside the installation prefix.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| astral-sh / uv | affected 0 through 0.8.21 |
CWE
CWE-22
References
- https://github.com/astral-sh/uv/security/advisories/GHSA-7j9j-68r2-f35q
- https://www.vulncheck.com/advisories/astral-uv-through-0.8.21-path-traversal-via-symlinks-in-sdist-tar-extraction
ADP enrichment
No English description supplied.
No references supplied.