CVE-2026-114110 Astral uv before 0.11.6 Arbitrary File Deletion via Wheel RECORD Entries
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-114110?
CVE-2026-114110 is a high-severity vulnerability in astral-sh uv, published on 21 Oct 2026.
Official description
Astral uv before 0.11.6 contains a path traversal vulnerability that allows attackers to delete arbitrary files by supplying wheels with relative traversal paths in RECORD entries. Attackers can craft a malicious wheel whose RECORD references files outside the installation prefix, causing uv to delete those files when the user uninstalls the package.
Weakness: CWE-23
Which versions are affected by CVE-2026-114110?
2 open source packages ship an affected version, including uv.
| Package | Affected | Fixed in |
|---|---|---|
uv PyPI | All versions | 0.11.6 |
uv PyPI | All versions | 0.11.6 |
How do I fix CVE-2026-114110?
Upgrade uv to 0.11.6 or later.
Is CVE-2026-114110 being exploited?
There is no known exploitation of CVE-2026-114110 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-114110, ECHO-a619-0831-e660, GHSA-pjjw-68hj-v9mw, UBUNTU-CVE-2026-114110.