CVE-2025-71437

CVSS 8.7 (high) · published 2026-10-21

Astral uv before 0.8.22 contains a path traversal vulnerability in source distribution (sdist) tar extraction that allows a specially crafted sequence of symlinks to redirect file writes outside the intended extraction prefix. Attackers can publish a malicious sdist that, when installed by a victim, writes arbitrary files to filesystem locations outside the installation prefix.

Weakness: CWE-22

Source: NVD CVE-2025-71437

References

• https://github.com/astral-sh/uv/security/advisories/GHSA-7j9j-68r2-f35q
• https://www.vulncheck.com/advisories/astral-uv-through-0.8.21-path-traversal-via-symlinks-in-sdist-tar-extraction

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.