CVE-2026-114110

Medium

Description

Astral uv before 0.11.6 contains a path traversal vulnerability that allows attackers to delete arbitrary files by supplying wheels with relative traversal paths in RECORD entries. Attackers can craft a malicious wheel whose RECORD references files outside the installation prefix, causing uv to delete those files when the user uninstalls the package.

SeverityMedium

CVSS5.3

Exploit probability—

ProductUv

PublishedOct 21, 2026

First seenOct 21, 2026

Weakness typeCWE-23CWE-23

How to fix

Update

uv0.11.6 or later

Vendor advisories

github.com/astral-sh/uv/security/advisories/GHSA-pjjw-68hj-v9mw

Affected products

Product	Affected versions	Fixed in
uvPyPI	v < 0.11.6	0.11.6

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.