CVE-2026-114109 uv before 0.11.15 Arbitrary File Write via Entry Point Names
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-114109?
CVE-2026-114109 is a high-severity vulnerability in astral-sh uv, published on 21 Oct 2026.
Official description
uv before 0.11.15 contains a path traversal vulnerability that allows malicious wheels to write files outside the scripts directory via crafted console_scripts or gui_scripts entry point names. Attackers who induce users to install a malicious wheel can place executables in PATH directories, shadowing or overwriting existing binaries for code execution.
Weakness: CWE-22
Which versions are affected by CVE-2026-114109?
4 open source packages ship an affected version, including uv.
| Package | Affected | Fixed in |
|---|---|---|
uv PyPI | All versions | 0.11.15 |
uv PyPI | All versions | 0.11.15 |
uv crates.io | All versions | 0.11.15 |
uv crates.io | All versions | 0.11.15 |
How do I fix CVE-2026-114109?
Upgrade uv to 0.11.15 or later.
Is CVE-2026-114109 being exploited?
There is no known exploitation of CVE-2026-114109 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-114109, ECHO-67a4-7019-33be, GHSA-4gg8-gxpx-9rph, GHSA-m8vc-5xpp-qpqf, MINI-8pwv-96gq-8r76, ROOT-APP-PYPI-GHSA-4gg8-gxpx-9rph and 1 more.