CVE-2026-104843: uv Package Path Traversal Vulnerability on Windows
Summary
CVE-2026-104843: uv: Path traversal on Windows through wheel extraction. Affects uv versions >= 0.12.7, < 0.12.18. Fixed in 0.12.18. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The uv package is a popular library in the Python ecosystem, primarily used for asynchronous I/O operations. It is designed to provide a high-performance event loop and is often utilized in applications requiring non-blocking I/O. However, certain versions of uv have been found to be vulnerable to a path traversal issue specifically on Windows systems, which could allow malicious actors to exploit the package during wheel installations.
Vulnerability Detail
In versions of the uv package from 0.12.7 to 0.12.18 on Windows, a path traversal vulnerability exists that allows an attacker to induce the package into writing files outside of the intended installation directory. This could lead to the placement of malicious executables in directories included in the user's PATH, potentially compromising the system's security. The vulnerability is classified under CWE-22, indicating a risk of improper restriction of pathname access.
How To Fix
Latest published version: 0.13.5 as of 22 Oct 2026
pip install --upgrade "uv==0.13.5"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.12.18
This is the first release that contains the fix.
pip install --upgrade "uv==0.12.18"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no effective workarounds other than upgrading to the patched version of the uv package (0.12.18 or newer). It is recommended to perform the upgrade as soon as possible to mitigate the risk associated with this vulnerability.
Conclusion
The uv package has a critical vulnerability that allows for path traversal on Windows systems, potentially leading to unauthorized file placements. Users are strongly encouraged to upgrade to version 0.12.18 or newer to mitigate this risk. Regular monitoring for vulnerabilities using tools like Vulert can help maintain the security of your applications.
See every vulnerability recorded for uv →
FAQ
The CVSS score of this vulnerability is 5.9, indicating a moderate level of risk.
The affected versions of the uv package range from 0.12.7 to 0.12.18.
No, this vulnerability specifically affects only Windows hosts; other platforms are not impacted.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
While there are no effective workarounds, it is crucial to plan for an upgrade to the patched version as soon as possible to ensure your system's security.
References
Related vulnerabilities
Recent vulnerabilities recorded for uv.
