Mmastodon TechnologyCybersecurity first seen 4 d ago, last 4 d ago, peak #4

High-severity path traversal flaw found in Astral uv package manager

Original: 🚨 EUVD-2025-211142 📊 Score: 8.7/10 (CVSS v3.1) 📦 Product: uv 🏢 Vendor: astral-sh 📅 Updated: 2026-10-21 📝 Astral uv befor

A vulnerability catalogued as EUVD-2025-211142 affects Astral's uv, the fast Python package manager, in versions before 0.8.22. The flaw, scored 8.7 out of 10 on CVSS v3.1, is a path traversal bug in the extraction of source distribution tar archives, where a crafted sequence of symlinks can allow files to be written outside the intended directory. Security teams are urged to update to 0.8.22 or later.

Why now: The advisory was recently updated, prompting developers to check and patch their uv installations.

AstraluvEUVD-2025-211142

Open on mastodon →

Evidence

• 🚨 EUVD-2025-211142 📊 Score: 8.7/10 (CVSS v3.1) 📦 Product: uv 🏢 Vendor: astral-sh 📅 Updated: 2026-10-21 📝 Astral uv before 0.8.22 contains a path traversal vulnerability in source distribution (sdist) tar extraction that allows a specially crafted sequence of symlinks to… · EUVD_Bot

API: https://socialmediatrends-api.osmike.com/v1/trends/3059117