astral-sh vulnerabilities
9 published CVEs name astral-sh among the affected products.
- 9Published CVEs9 of them scored
- 6Last 12 monthspublished in the last year
- 0Critical4 more rated high
- 0Known exploitedin CISA's KEV catalog
Newest CVEs
- CVE-2026-114110
Astral uv before 0.11.6 Arbitrary File Deletion via Wheel RECORD Entries
astral-sh · uv
High8.7 - CVE-2026-114109
uv before 0.11.15 Arbitrary File Write via Entry Point Names
astral-sh · uv
High8.7 - CVE-2025-71437
Astral uv through 0.8.21 Path Traversal via Symlinks in Sdist Tar Extraction
astral-sh · uv
High8.7 - CVE-2026-104843
uv: Path traversal on Windows through wheel extraction
astral-sh · uv
Medium5.9 - CVE-2026-32766
astral-tokio-tar insufficiently validates PAX extensions during extraction
astral-sh · tokio-tar
Low1.7 - CVE-2025-13327
Uv: uv: specially crafted zip archives lead to arbitrary code execution due to parsing differentials
astral-sh · uv
Medium6.3 - CVE-2025-62518
astral-tokio-tar Vulnerable to PAX Header Desynchronization
astral-sh · tokio-tar
High8.1 - CVE-2025-59825
astral-tokio-tar has a path traversal in tar extraction
astral-sh · tokio-tar
Medium6.1 - CVE-2025-54368
uv is vulnerable to ZIP payload obfuscation through parsing differentials
astral-sh · uv
Medium6.8