{"action":"Upgrade uv to 0.9.5 or later.","affected":[{"fixed":"0.9.5","introduced":"0"}],"component":"uv","cve_ids":[],"ecosystem":"PyPI","exploited":false,"fixed_versions":["0.9.5"],"ghsa_id":"GHSA-w476-p2h3-79g9","id":"tcs_01M5KG1BJ22QPRFYNXW8V73FMR","modified_at":"2026-02-04T02:52:40.515314Z","published_at":"2025-10-21T18:53:27Z","references":["https://osv.dev/vulnerability/GHSA-w476-p2h3-79g9","https://github.com/astral-sh/uv/security/advisories/GHSA-w476-p2h3-79g9","https://github.com/astral-sh/uv/pull/16387","https://github.com/astral-sh/uv/commit/ae450662d1546e9853f67a8c61a506d3a892d963","https://github.com/advisories/GHSA-j5gw-2vrg-8fgx","https://github.com/astral-sh/uv","https://github.com/astral-sh/uv/releases/tag/0.9.5"],"severity":{"label":"low"},"sources":[{"source":"osv","source_id":"GHSA-w476-p2h3-79g9","url":"https://osv.dev/vulnerability/GHSA-w476-p2h3-79g9"}],"summary":"uv has differential in tar extraction with PAX headers"}