{"action":"Upgrade uv to 0.9.6 or later.","affected":[{"fixed":"0.9.6","introduced":"0"}],"component":"uv","cve_ids":["CVE-2025-13327"],"ecosystem":"crates.io","epss":0.00172,"exploited":false,"fixed_versions":["0.9.6"],"ghsa_id":"GHSA-v653-r55g-hcmg","id":"tcs_01M5KF3CKQBQBGH7PQ5743T18Z","modified_at":"2026-10-30T00:45:06.541337146Z","published_at":"2026-02-27T09:30:29Z","references":["https://osv.dev/vulnerability/GHSA-v653-r55g-hcmg","https://github.com/astral-sh/uv/security/advisories/GHSA-pqhf-p39g-3x64","https://nvd.nist.gov/vuln/detail/CVE-2025-13327","https://github.com/astral-sh/uv/commit/da659fee4898a73dbc75070f3e82d49f745e4628","https://access.redhat.com/security/cve/CVE-2025-13327","https://bugzilla.redhat.com/show_bug.cgi?id=2407263","https://github.com/astral-sh/uv","https://access.redhat.com/errata/RHSA-2026:91219","https://access.redhat.com/errata/RHSA-2026:91232","https://access.redhat.com/errata/RHSA-2026:91236"],"severity":{"label":"medium","score":6.3},"sources":[{"source":"osv","source_id":"GHSA-v653-r55g-hcmg","url":"https://osv.dev/vulnerability/GHSA-v653-r55g-hcmg"}],"summary":"uv has ZIP payload obfuscation through parsing differentials"}