Bug 2557971 (CVE-2026-114109)

Summary: CVE-2026-114109 uv: uv: Arbitrary code execution via path traversal in entry point names
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: alinfoot, anpicker, aprice, bbrownin, dtrifiro, ebourniv, gbenhaim, hasun, ilpinto, jfula, jowilson, jsamir, ltomasbo, mwoodson, niyer, nyancey, oezr, ometelka, ptisnovs, sbunciak, syedriko, twaugh, weaton, xdharmai, ykashtan
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in uv. An attacker who convinces a user to install a malicious package can achieve arbitrary code execution. Because uv does not properly restrict entry point names, installing a crafted wheel package allows files to be written outside the intended directory, enabling an attacker to place or overwrite executable files in system search path directories.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-10-21 00:55:44 UTC 
uv before 0.11.15 contains a path traversal vulnerability that allows malicious wheels to write files outside the scripts directory via crafted console_scripts or gui_scripts entry point names. Attackers who induce users to install a malicious wheel can place executables in PATH directories, shadowing or overwriting existing binaries for code execution.