CVE-2026-104843

[CVE catalog]

Severity

High · CVSS 7.8CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Published

Oct 2, 2026, 3:29:15 PM UTC

Updated

Oct 2, 2026, 4:16:46 PM UTC

Source

[NVD] · [CVE record]

EPSS

0.43% · Oct 25, 2026

A flaw was found in uv. An attacker could achieve arbitrary code execution on a Windows system by tricking a user into installing a specially crafted Python wheel package. During archive extraction, files can be written outside the intended target directory, allowing an attacker to place malicious executable files into locations within the system search path (PATH). uv: uv: Arbitrary code execution via malicious package extraction on Windows Red Hat rates this IMPORTANT vulnerability in uv, a Python package and project manager written in Rust, which is shipped in affected Red Hat offerings across AI and development-tools components. During installation of a Python wheel on Windows, uv could be induced by a maliciously crafted wheel to write files outside the intended installation directory, including placing an executable into a directory already present on the user's PATH. By tricking a user into installing such a wheel, an attacker could achieve arbitrary code execution in the context of that user when the planted executable is subsequently invoked, compromising the confidentiality, integrity, and availability of the user's account. Non-Windows hosts are not affected. The Red Hat severity of IMPORTANT (CVSS 3.1 score 7.8) differs from the upstream rating of MODERATE (CVSS 4.0 score 5.9) primarily because the upstream vector scores integrity-only impact requiring user interaction, while the Red Hat vector accounts for high impact to confidentiality, integrity, and availability within the user's security context. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.