CVE-2026-104843 uv: Path traversal on Windows through wheel extraction
Attackers can write executable files outside the installation directory on Windows via malicious wheels, potentially leading to code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-104843?
CVE-2026-104843 is a medium-severity path traversal vulnerability in astral-sh uv, published on 2 Oct 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
uv is a Python package and project manager written in Rust. From 0.12.7 until 0.12.18, uv wheel extraction on Windows can process a malicious wheel in a way that writes a file outside the installation prefix, including an executable in a directory already present on the user's PATH. Non-Windows hosts are not affected. This issue is fixed in version 0.12.18.
Weakness: CWE-22
Which versions are affected by CVE-2026-104843?
5 open source packages ship an affected version, including uv.
| Package | Affected | Fixed in |
|---|---|---|
uv PyPI | From 0.12.7 | 0.12.18 |
uv PyPI | From 0.12.7 | 0.12.18 |
uv PyPI | From 0.12.7 | 0.12.18 |
uv crates.io | From 0.12.7 | 0.12.18 |
uv crates.io | From 0.12.7 | 0.12.18 |
How do I fix CVE-2026-104843?
Upgrade uv to 0.12.18 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-104843 being exploited?
There is no known exploitation of CVE-2026-104843 in the wild and no public exploit code.
Sources
Also known as GHSA-2cv4-cqwr-gwf7, MINI-vw9h-ghgq-j4vj, PYSEC-2026-4305, UBUNTU-CVE-2026-104843.