GHSA-v653-r55g-hcmg
Medium · 6.3CVSS
6.3
EPSS
—
Published
Feb 27, 2026
CISA due date
—
The record
uv has ZIP payload obfuscation through parsing differentials
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| PyPI | uv | 0 | 0.9.6 |
| crates.io | uv | 0 | 0.9.6 |
Related vulnerabilities
- CVE-2025-13327 A flaw was found in uv. Same vulnerability
- GHSA-4gg8-gxpx-9rph uv is vulnerable to arbitrary file write through entry point names Also affects uv
- CVE-2025-62518 astral-tokio-tar is a tar archive reading/writing library for async Rust. Also affects uv
- CVE-2025-54368 uv is a Python package and project manager written in Rust. Also affects uv
- CVE-2026-83611 xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and… CWE-1286
- CVE-2026-72916 Mastodon is a free, open-source social network server based on ActivityPub. CWE-1286
- CVE-2026-0931 Denial-of-service vulnerability in M-Files Server versions before 26.5.16015.3 allows an… CWE-1286
- CVE-2026-55767 Guzzle is an extensible PHP HTTP client. CWE-1286