Vendor
Astral-sh
9 known vulnerabilities in products by Astral-sh, 0 of them actively exploited (CISA KEV).
Key figures
9
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
0
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| High | CVE-2026-114109 | uv before 0.11.15 Arbitrary File Write via Entry Point Names | 8.8 | |
| High | CVE-2026-114110 | Astral uv before 0.11.6 Arbitrary File Deletion via Wheel RECORD Entries | 5.3 | |
| High | CVE-2025-71437 | Astral uv through 0.8.21 Path Traversal via Symlinks in Sdist Tar Extraction | 6.5 | |
| High | CVE-2025-62518 | astral-tokio-tar Vulnerable to PAX Header Desynchronization | 8.1 | |
| Medium | CVE-2026-104843 | uv: Path traversal on Windows through wheel extraction | — | |
| Medium | CVE-2025-13327 | Uv: uv: specially crafted zip archives lead to arbitrary code execution due to parsing differentials | 6.3 | |
| Medium | CVE-2025-54368 | uv is vulnerable to ZIP payload obfuscation through parsing differentials | — | |
| Medium | CVE-2026-32766 | astral-tokio-tar insufficiently validates PAX extensions during extraction | 5.3 | |
| Medium | CVE-2025-59825 | astral-tokio-tar has a path traversal in tar extraction | — |