ghsa:GHSA-M3WX-QQMX-QXVF: uv < 0.11.6

Affected technology

uv · < 0.11.6
Vendor not specified by the source

Component: Not specified by the source

Attack conditions (Source advisory, CVSS 3.1): Network (remote) · No privileges required · User interaction required

What an attacker can do

Attackers can craft a malicious wheel whose RECORD references files outside the installation prefix, causing uv to delete those files when the user uninstalls the package. Source advisory’s CVSS 3.1 assessment rates confidentiality impact as high; integrity and availability impact as none.