PyPI/uv CVE-2025-13327: medium 6.3, EPSS 0.17%
uv allows ZIP payload obfuscation through parsing differentials
Action: Upgrade uv to 0.9.6 or later.
pip install uv==0.9.6Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 0.9.6 | - |
Fixed versions
| 0.9.6 |
Sources
- osv: GHSA-pqhf-p39g-3x64
- nvd: CVE-2025-13327
- https://github.com/astral-sh/uv/security/advisories/GHSA-pqhf-p39g-3x64
- https://github.com/astral-sh/uv/commit/da659fee4898a73dbc75070f3e82d49f745e4628
- https://github.com/astral-sh/uv
CVE-2025-13327 · published · modified · JSON