CVE-2025-13327
A flaw was found in uv.
Published Feb 27, 2026 · updated Jun 17, 2026 · astral uv
A flaw was found in uv. This vulnerability allows an attacker to execute malicious code during package resolution or installation via specially crafted ZIP (Zipped Information Package) archives that exploit parsing differentials, requiring user interaction to install an attacker-controlled package.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Feb 27, 2026 · NIST NVD
Detected
A flaw was found in uv. This vulnerability allows an attacker to execute malicious code during package resolution or installation via specially crafted ZIP (Zipped Information Package) archives that exploit parsing differentials, requiring user interaction to install an attacker-controlled package.
Jun 17, 2026 · NIST NVD
Updated
A flaw was found in uv. This vulnerability allows an attacker to execute malicious code during package resolution or installation via specially crafted ZIP (Zipped Information Package) archives that exploit parsing differentials, requiring user interaction to install an attacker-controlled package.
Affected
- cpe astral/uvversion unspecified
Sources
- CVE.orgVulnerability recordCVE-2025-13327
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2025-13327
A flaw was found in uv. This vulnerability allows an attacker to execute malicious code during package resolution or installation via specially crafted ZIP (Zipped Information Package) archives that exploit parsing differentials, requiring user interaction to install an attacker-
nvd.nist.gov