{"action":"Upgrade uv to 0.9.6 or later.","affected":[{"fixed":"0.9.6","introduced":"0"}],"component":"uv","cve_ids":["CVE-2025-13327"],"ecosystem":"PyPI","epss":0.00171,"exploited":false,"fixed_versions":["0.9.6"],"ghsa_id":"GHSA-pqhf-p39g-3x64","id":"tcs_01M5KFTHYHZBEMYFVB4XVQM36Y","modified_at":"2026-07-13T07:26:48.000099082Z","published_at":"2025-10-29T22:12:57Z","references":["https://osv.dev/vulnerability/GHSA-pqhf-p39g-3x64","https://github.com/astral-sh/uv/security/advisories/GHSA-pqhf-p39g-3x64","https://github.com/astral-sh/uv/commit/da659fee4898a73dbc75070f3e82d49f745e4628","https://github.com/astral-sh/uv"],"severity":{"label":"medium","score":6.3},"sources":[{"source":"osv","source_id":"GHSA-pqhf-p39g-3x64","url":"https://osv.dev/vulnerability/GHSA-pqhf-p39g-3x64"},{"source":"nvd","source_id":"CVE-2025-13327","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-13327"}],"summary":"uv allows ZIP payload obfuscation through parsing differentials"}