{"action":"Upgrade uv to 0.13.4 or later.","affected":[{"fixed":"0.13.4","introduced":"0"}],"component":"uv","cve_ids":[],"ecosystem":"PyPI","exploited":false,"fixed_versions":["0.13.4"],"ghsa_id":"GHSA-hq85-5cpj-mr62","id":"tcs_01M5JK99J3JA96D95SZ1G0APXH","modified_at":"2026-10-20T22:11:14.153464093Z","published_at":"2026-10-20T19:37:52Z","references":["https://osv.dev/vulnerability/GHSA-hq85-5cpj-mr62","https://github.com/astral-sh/uv/security/advisories/GHSA-hq85-5cpj-mr62","https://github.com/certifi/python-certifi/security/advisories/GHSA-6q48-6c7w-9gw2","https://emudhra.we-have-a-problem.com","https://github.com/astral-sh/uv","https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/0R3XLJL6FuE/m/0XofdebrAAAJ"],"severity":{"label":"critical"},"sources":[{"source":"osv","source_id":"GHSA-hq85-5cpj-mr62","url":"https://osv.dev/vulnerability/GHSA-hq85-5cpj-mr62"}],"summary":"uv's bundled CA store trusts an emSign root whose intermediate CA keys are compromised"}