More information about this security flaw is available in the following bug: https://bugzilla.redhat.com/show_bug.cgi?id=2328554 Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
I was able to reproduce this in uv 0.5.2 and earlier. It appears to be fixed or mitigated in uv 0.5.3 and later. I have asked upstream to comment on whether they believe the issue is entirely dealt with, or whether there is further work to be done, in “Please comment on CVE-2024-53899 and virtualenv activation scripts,” https://github.com/astral-sh/uv/issues/9424. In any case, uv 0.4.30 as currently shipped in Fedora 39 *is* affected by this issue. However, Fedora 39 is one day from its end-of-life date, so it is too late to fix this.