CVE-2026-104843
UNKNOWN
NVD
CVSS Score
0
Severity
UNKNOWN
Published
Oct 02, 2026
Vendor
unknown
Description
uv is a Python package and project manager written in Rust. From 0.12.7 until 0.12.18, uv wheel extraction on Windows can process a malicious wheel in a way that writes a file outside the installation prefix, including an executable in a directory already present on the user's PATH. Non-Windows hosts are not affected. This issue is fixed in version 0.12.18.