← Back

CVE-2025-13327

nvd nist
Published: Feb 27, 2026Modified: Jun 17, 2026

JSON object

Loading...
6.3
Vector
CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H
Exploitability: 0.3 / Impact: 5.9
Source: NVD

Description

A flaw was found in uv. This vulnerability allows an attacker to execute malicious code during package resolution or installation via specially crafted ZIP (Zipped Information Package) archives that exploit parsing differentials, requiring user interaction to install an attacker-controlled package.

Affected (1)

Products: Astral: Uv
Astral
1 product
Uv
Configuration A
1 vulnerable
Vulnerable SoftwareAffected Versions
Uv
Before 0.9.6

Related CWEs

CWE-1286
Improper Validation of Syntactic Correctness of Input
The product receives input that is expected to be well-formed - i.e., to comply with a certain syntax - but it does not validate or incorrectly validates that the input complies with the syntax.

References (5)

Source: secalert@redhat.com
Third Party Advisory
Source: secalert@redhat.com
Issue Tracking
Source: secalert@redhat.com
Product
Source: secalert@redhat.com
Patch
Source: secalert@redhat.com
Vendor Advisory

Timeline

No history available yet.