GHSA-pjjw-68hj-v9mw

What it actually does

uv versions 0.11.5 and earlier fail to reject wheel metadata where the `.dist-info/RECORD` file contains relative paths that traverse outside the wheel installation prefix, such as `../` path components. uv uses `RECORD` entries during uninstall to decide which files to remove. A maliciously crafted Python wheel can therefore cause uv to delete files outside the installed package directory when the package is uninstalled. The flaw does not allow arbitrary file creation or modification during installation, and absolute paths are treated as relative to the installation prefix, so the primary impact is arbitrary file deletion constrained by the permissions of the user running uninstall. Exploitation requires both installation and later uninstallation of the malformed wheel, and the attacker must craft traversal paths that correctly account for the installation directory depth.

Why it matters to the business

This issue can cause accidental or attacker-induced deletion of application, virtual environment, user, or system files when a malicious Python package is uninstalled with an affected uv version. The most likely business impact is service disruption, broken builds, corrupted developer environments, failed deployments, or loss of local files. Because exploitation requires a specially crafted wheel and an uninstall action, and because there is no known KEV listing or ransomware association, urgency is moderate rather than emergency; however, organizations that install packages from untrusted indexes, internal mirrors, CI/CD pipelines, or third-party artifacts should prioritize remediation to prevent supply-chain-triggered disruption.

How an attack unfolds

An attacker creates or modifies a Python wheel so that its `.dist-info/RECORD` file includes relative traversal entries pointing outside the package installation prefix. The wheel otherwise appears installable and may be distributed through a package index, dependency confusion route, compromised artifact repository, direct download, or internal supply-chain channel. A user, build job, or automation process installs the wheel with uv 0.11.5 or earlier. Installation does not use the malicious `RECORD` paths to place files outside the prefix, so the issue may remain dormant. Later, when the package is uninstalled, uv trusts the invalid `RECORD` entries and attempts to remove the listed files. If the traversal depth and target filenames match real files and the uninstalling user has permission to delete them, those files are removed, potentially damaging applications, environments, or system state.

How to fix it

Upgrade uv to a version newer than 0.11.5 that rejects or safely handles invalid wheel `RECORD` path entries. If package-level fixed versions are maintained internally, require the fixed uv version in developer workstations, build images, CI runners, container base images, and dependency management tooling. Until upgraded, avoid uninstalling packages installed from untrusted or manually built wheels with affected uv versions. Prefer trusted package indexes, verified artifact provenance, pinned dependencies, hash-checked installs, and isolated disposable virtual environments for untrusted packages. Remove or quarantine any wheel whose `.dist-info/RECORD` contains parent-directory traversal such as `../` or `..\`. For high-risk environments, rebuild virtual environments rather than uninstalling suspicious packages in place.

How to confirm the fix worked

Confirm that `uv --version` reports a version later than 0.11.5 on developer endpoints, CI/CD runners, build containers, and automation images. Test package handling by attempting to install or process a benign test wheel with a `RECORD` entry containing parent-directory traversal and verify that the fixed uv version rejects it or does not honor the invalid path during uninstall. Inventory installed distributions and cached wheel artifacts for `.dist-info/RECORD` entries containing `../` or `..\`. Review CI images and lockfiles to ensure the vulnerable uv binary is not reintroduced by base image rebuilds or bootstrap scripts.

Typical attack path

1. Craft a Python wheel with a manipulated `.dist-info/RECORD` file containing relative path traversal entries such as `../../../target-file`.
2. Distribute the wheel through a package index, artifact repository, dependency confusion package name, phishing link, compromised project, or internal build dependency path.
3. Wait for a developer, CI/CD job, or automation process using uv 0.11.5 or earlier to install the wheel.
4. Rely on the malicious metadata remaining present after installation without obvious runtime symptoms.
5. Trigger or wait for package uninstall, environment cleanup, dependency replacement, or build teardown using the affected uv version.
6. During uninstall, uv reads the invalid `RECORD` entries and deletes files outside the package installation prefix if the paths resolve to existing files and permissions allow removal.

How to detect it

To determine whether this was already exploited, review package installation and uninstall activity from developer endpoints, CI/CD systems, build logs, shell histories, container build logs, and artifact repository access logs. Focus on cases where uv 0.11.5 or earlier installed and later uninstalled the same wheel or package, especially from untrusted, newly introduced, direct URL, or internal mirror sources. Inspect installed package metadata, wheel caches, artifact repositories, and preserved build workspaces for `.dist-info/RECORD` files containing parent-directory traversal. Correlate suspicious uninstall events with unexpected file deletion errors, missing configuration files, broken virtual environments, failed builds, or file integrity monitoring alerts. If available, compare filesystem snapshots or backups before and after package uninstall operations to identify deleted files outside the package prefix. There are no known public threat actors or KEV exploitation reports associated with this advisory, so detection should be behavior- and artifact-focused rather than actor-specific.

• .dist-info/RECORD
• ../
• ..\\
• /RECORD:../
• /RECORD:..\\
• uv pip uninstall
• uv pip install
• uv uninstall
• Deleting file outside package prefix
• RECORD contains relative path traversal
• ../../../
• ..\/..\/
• site-packages/*.dist-info/RECORD

What your security team should do

• Prioritize upgrading uv wherever it is used for Python package installation, especially in CI/CD, release engineering, developer workstations, and build containers.
• Search artifact repositories, package caches, source trees, and installed environments for wheel `RECORD` files containing `../` or `..\` traversal entries.
• Treat any package with malformed `RECORD` traversal entries as suspicious unless there is a documented benign test purpose; quarantine the artifact and investigate its source.
• Avoid uninstalling suspicious packages with uv 0.11.5 or earlier; preserve evidence first, then rebuild the environment from trusted inputs.
• Enforce package provenance controls such as approved indexes, dependency pinning, hash verification, signed artifacts where available, and restrictions on direct wheel installation from untrusted sources.
• Add CI checks that inspect wheels before publication or installation and fail builds when `.dist-info/RECORD` contains absolute paths, parent-directory traversal, or non-normalized paths.
• Monitor for unexpected file deletion or environment corruption following Python package uninstall operations, particularly in automation jobs that recently installed third-party wheels.