{"action":"Upgrade uv to 0.9.6 or later.","affected":[{"fixed":"0.9.6","introduced":"0"}],"component":"uv","cve_ids":["CVE-2025-13327"],"ecosystem":"PyPI","epss":0.00172,"exploited":false,"fixed_versions":["0.9.6"],"ghsa_id":"GHSA-pqhf-p39g-3x64","id":"tcs_01M5KGYKTC6H4612TKK0PM4VW9","modified_at":"2026-07-13T07:26:48.000099082Z","published_at":"2026-02-27T08:17:04.043Z","references":["https://osv.dev/vulnerability/PYSEC-2026-2295","https://access.redhat.com/security/cve/CVE-2025-13327","https://github.com/astral-sh/uv/security/advisories/GHSA-pqhf-p39g-3x64","https://bugzilla.redhat.com/show_bug.cgi?id=2407263","https://github.com/astral-sh/uv/commit/da659fee4898a73dbc75070f3e82d49f745e4628","https://github.com/astral-sh/uv"],"severity":{"label":"medium","score":6.3},"sources":[{"source":"osv","source_id":"PYSEC-2026-2295","url":"https://osv.dev/vulnerability/PYSEC-2026-2295"}],"summary":"A flaw was found in uv. This vulnerability allows an attacker to execute malicious code during package resolution or installation via specially crafted ZIP (Zipped Information Package) archives that e"}