GHSA-4gg8-gxpx-9rph

Affected versions of the `uv` package are vulnerable to Path Traversal due to improper handling of entry point specifications during installation. The installation process fails to restrict the placement of generated entry points to the environment's scripts directory, allowing them to be placed in arbitrary locations. An attacker can exploit this by crafting a malicious wheel that, when installed, places an executable in a directory on the user's `PATH`, potentially leading to unexpected code execution.