PyPI/uv CVE-2025-54368: medium, EPSS 0.21%

uv allows ZIP payload obfuscation through parsing differentials

Action: Upgrade uv to 0.8.6 or later.

pip install uv==0.8.6

Affected

Fixed versions

Sources

• osv: GHSA-8qf3-x8v5-2pj8
• https://github.com/astral-sh/uv/security/advisories/GHSA-8qf3-x8v5-2pj8
• https://nvd.nist.gov/vuln/detail/CVE-2025-54368
• https://github.com/astral-sh/uv/commit/7f1eaf48c193e045ca2c62c4581048765c55505f
• https://astral.sh/blog/uv-security-advisory-cve-2025-54368
• https://blog.pypi.org/posts/2025-08-07-wheel-archive-confusion-attacks
• https://github.com/astral-sh/uv

CVE-2025-54368 · published 2025-08-07T20:52:44Z · modified 2026-07-07T17:56:47.324052692Z · JSON