{"id":"CVE-2026-114110","published":"2026-10-21T01:17:37.103","lastModified":"2026-10-22T17:39:56.760","description":"Astral uv before 0.11.6 contains a path traversal vulnerability that allows attackers to delete arbitrary files by supplying wheels with relative traversal paths in RECORD entries. Attackers can craft a malicious wheel whose RECORD references files outside the installation prefix, causing uv to delete those files when the user uninstalls the package.","cvssScore":5.3,"cvssSeverity":"MEDIUM","cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","cwes":["CWE-23"],"vendors":[],"products":[],"references":[{"url":"https://github.com/astral-sh/uv/security/advisories/GHSA-pjjw-68hj-v9mw","tags":[]},{"url":"https://www.vulncheck.com/advisories/astral-uv-before-0.11.6-arbitrary-file-deletion-via-wheel-record-entries","tags":[]}],"exploitRefs":[{"url":"https://github.com/astral-sh/uv/security/advisories/GHSA-pjjw-68hj-v9mw","tags":[]}],"hasPoc":true,"ai":null}