Home

Description

A flaw was found in uv. This vulnerability allows an attacker to execute malicious code during package resolution or installation via specially crafted ZIP (Zipped Information Package) archives that exploit parsing differentials, requiring user interaction to install an attacker-controlled package.

PUBLISHED Reserved 2025-11-17 | Published 2026-02-27 | Updated 2026-02-27 | Assigner redhat




MEDIUM: 6.3CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H

Problem types

Improper Validation of Syntactic Correctness of Input

Product status

Default status
unaffected

Any version before 0.9.6
affected

Default status
unaffected

Default status
unaffected

Default status
unaffected

Default status
affected

Default status
affected

Default status
affected

Default status
affected

Default status
affected

Default status
affected

Default status
affected

Default status
affected

Default status
affected

Default status
affected

Default status
affected

Default status
affected

Default status
affected

Default status
affected

Default status
affected

Default status
affected

Default status
affected

Default status
affected

Default status
affected

Default status
affected

Default status
affected

Default status
affected

Default status
affected

Default status
affected

Timeline

2025-10-29:Reported to Red Hat.
2025-10-29:Made public.

References

access.redhat.com/security/cve/CVE-2025-13327 vdb-entry

bugzilla.redhat.com/show_bug.cgi?id=2407263 (RHBZ#2407263) issue-tracking

github.com/astral-sh/uv

github.com/...ommit/da659fee4898a73dbc75070f3e82d49f745e4628

github.com/...-sh/uv/security/advisories/GHSA-pqhf-p39g-3x64

cve.org (CVE-2025-13327)

nvd.nist.gov (CVE-2025-13327)

Download JSON