CVE-2025-13327
3 advisories.
crates.io/uv CVE-2025-13327: medium 6.3, EPSS 0.16%
uv has ZIP payload obfuscation through parsing differentials
Action: Upgrade uv to 0.9.6 or later.
cargo update -p uv --precise 0.9.6Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 0.9.6 | - |
Fixed versions
| 0.9.6 |
Sources
- osv: GHSA-v653-r55g-hcmg
- https://github.com/astral-sh/uv/security/advisories/GHSA-pqhf-p39g-3x64
- https://nvd.nist.gov/vuln/detail/CVE-2025-13327
- https://github.com/astral-sh/uv/commit/da659fee4898a73dbc75070f3e82d49f745e4628
- https://access.redhat.com/security/cve/CVE-2025-13327
- https://bugzilla.redhat.com/show_bug.cgi?id=2407263
- https://github.com/astral-sh/uv
CVE-2025-13327 · published · modified · JSON
PyPI/uv CVE-2025-13327: medium 6.3, EPSS 0.16%
A flaw was found in uv. This vulnerability allows an attacker to execute malicious code during package resolution or installation via specially crafted ZIP (Zipped Information Package) archives that e
Action: Upgrade uv to 0.9.6 or later.
pip install uv==0.9.6Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 0.9.6 | - |
Fixed versions
| 0.9.6 |
Sources
- osv: PYSEC-2026-2295
- https://access.redhat.com/security/cve/CVE-2025-13327
- https://github.com/astral-sh/uv/security/advisories/GHSA-pqhf-p39g-3x64
- https://bugzilla.redhat.com/show_bug.cgi?id=2407263
- https://github.com/astral-sh/uv/commit/da659fee4898a73dbc75070f3e82d49f745e4628
- https://github.com/astral-sh/uv
CVE-2025-13327 · published · modified · JSON
PyPI/uv CVE-2025-13327: medium 6.3, EPSS 0.16%
uv allows ZIP payload obfuscation through parsing differentials
Action: Upgrade uv to 0.9.6 or later.
pip install uv==0.9.6Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 0.9.6 | - |
Fixed versions
| 0.9.6 |
Sources
- osv: GHSA-pqhf-p39g-3x64
- nvd: CVE-2025-13327
- https://github.com/astral-sh/uv/security/advisories/GHSA-pqhf-p39g-3x64
- https://github.com/astral-sh/uv/commit/da659fee4898a73dbc75070f3e82d49f745e4628
- https://github.com/astral-sh/uv
CVE-2025-13327 · published · modified · JSON