{"action":"Upgrade uv to 0.13.4 or later.","affected":[{"fixed":"0.13.4","introduced":"0"}],"component":"uv","cve_ids":[],"ecosystem":"PyPI","exploited":false,"fixed_versions":["0.13.4"],"ghsa_id":"GHSA-hq85-5cpj-mr62","id":"tcs_01M5JK990RNKE6W7NMFPM36NTW","modified_at":"2026-10-20T22:00:02.616367477Z","published_at":"2026-10-20T21:49:27.535265Z","references":["https://osv.dev/vulnerability/PYSEC-2026-4321","https://github.com/astral-sh/uv/security/advisories/GHSA-hq85-5cpj-mr62","https://github.com/certifi/python-certifi/security/advisories/GHSA-6q48-6c7w-9gw2","https://emudhra.we-have-a-problem.com","https://github.com/astral-sh/uv","https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/0R3XLJL6FuE/m/0XofdebrAAAJ","https://pypi.org/project/uv","https://github.com/advisories/GHSA-hq85-5cpj-mr62"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2026-4321","url":"https://osv.dev/vulnerability/PYSEC-2026-4321"}],"summary":"uv's bundled CA store trusts an emSign root whose intermediate CA keys are compromised"}