astral-sh CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

MEDIUM astral-sh CVE published 2026-10-05

CVE-2026-104843

A path traversal vulnerability in uv, affecting Windows hosts from version 0.12.7 to 0.12.18, allows a malicious wheel to place an executable outside the intended environment, potentially on the user's PATH. This issue is addressed in uv version 0.12.18 and later. The vulnerability can be exploited by a malicious wheel to write a file outside of the installation prefix during wheel installation. Users of [truncated]