CVE-2026-104843

Affected versions of the `uv` package are vulnerable to Path Traversal due to wheel extraction on Windows not confining the paths of extracted files to the installation prefix. During wheel installation on Windows hosts, uv writes files at paths taken from the wheel archive without ensuring that they resolve inside the target environment, so a crafted archive entry can be written to a location outside the installation prefix. An attacker who gets a Windows user to install a malicious wheel with uv can place an executable outside the intended environment, including in a directory already on the user's `PATH`, where it can be run in place of a legitimate command and execute arbitrary code.