ghsa:GHSA-HQ85-5CPJ-MR62: uv < 0.13.4

uv's bundled CA store trusts an emSign root whose intermediate CA keys are compromised. Affected range: < 0.13.4. Fixed version: 0.13.4.

Affected technology

uv · < 0.13.4
Vendor not specified by the source

Component: Not specified by the source

What an attacker can do

An attacker with one of the compromised keys can issue certificates that uv accepts for any hostname, and can be used to issue certificates to enable MITM attacks. uv 0.13.4 removes the root from its vendored bundle, following `webpki-root-certs` 1.0.10.

Published 21-Oct-2026 05:33 UTC

Product: uv
KEV: no

Provenance

GitHub Advisory Database · Source record · observed 2026-10-21 04:17:24.410927+00:00 UTC

Stable permalink: https://cybercodered.org/item/adv-ghsa-ghsa-hq85-5cpj-mr62.html