An extremely fast Python package and project manager, written in Rust.
MIT OR Apache-2.0
All Versions
Vulnerabilities (Public)
Known vulnerabilities and security issues detected in the extension's dependencies and code.
| Vulnerability ID | Advisory | Affected Versions | |||
|---|---|---|---|---|---|
| SFTY-20261020-91055 | uv – Improper Certificate Validation | Critical | – | – | < 0.13.4 |
| CVE-2026-104843 | uv – Path Traversal | Medium | – | – | >= 0.12.7, < 0.12.18 |
| CVE-2025-54368 | Affected versions of the uv package are vulnerable to Improper Input Validation due to inadequate verification of ZIP central directory data and End-of-Central-Directory offsets in the streaming extra… | Medium | – | – | <0.8.6 |
| SFTY-20260529-84264 | uv – Path Traversal | Unknown | – | – | < 0.11.15 |
| SFTY-20260410-86374 | uv vulnerable to arbitrary file deletion through RECORD entries | Unknown | – | – | <= 0.11.5 |
| SFTY-20251030-37150 | Affected versions of the uv package (<= 0.9.5) are vulnerable to Improper Input Validation due to inconsistent parsing of ZIP central directory comment fields and ambiguous filename handling. The ZIP … | Unknown | – | – | <0.9.6 |
| SFTY-20251021-47509 | uv has differential in tar extraction with PAX headers | Unknown | – | – | <= 0.9.4 |
Safety Discovered Vulnerabilities
Additional security issues found by Safety, exclusive to our platform.