uv
0.13.8An extremely fast Python package and project manager, written in Rust.
- Maintenance
- Active1381 commits in 3 months · bus factor 2
- License
- Apache-2.0Permissive · OSI-approved
- Security
- 8 advisories1 high, 4 medium, 3 low
- Supported versions
- No scheduleendoflife.date does not track this project
92k stars · 3.8k forks · 3.1k open issues · last release 2 days ago · data checked 2 hours ago
Security advisories
All advisories on GitHubThe 8 most recent advisories published by the maintainers: 1 high, 4 medium, 3 low. Check the patched version against the one you run.
- highCVE-2026-119327Oct 20, 2026Removal of emSign root certificate
- Affected
- <0.13.4
- Patched in
- >=0.13.4
- mediumCVE-2026-104843Sep 23, 2026Path traversal on Windows through wheel extraction
- Affected
- >= 0.12.7, < 0.12.18
- Patched in
- >= 0.12.18
- mediumGHSA-4gg8-gxpx-9rphMay 18, 2026Arbitrary file write through entry point names
- Affected
- < 0.11.15
- Patched in
- 0.11.15
- lowGHSA-pjjw-68hj-v9mwApr 9, 2026Abitrary file deletion through RECORD entries
- Affected
- <= 0.11.5
- Patched in
- 0.11.6
- mediumGHSA-pqhf-p39g-3x64Oct 29, 2025ZIP payload obfuscation through parsing differentials
- Affected
- <= 0.9.5
- Patched in
- 0.9.6
- lowGHSA-w476-p2h3-79g9Oct 21, 2025Differential in tar extraction with PAX headers
- Affected
- <= 0.9.4
- Patched in
- 0.9.5
- lowGHSA-7j9j-68r2-f35qSep 23, 2025Path traversal in tar extraction
- Affected
- <= 0.8.21
- mediumCVE-2025-54368Aug 7, 2025ZIP payload obfuscation through parsing differentials
- Affected
- < 0.8.5
- Patched in
- 0.8.6