Vulnerability · Published Oct 21, 2026 · Assigned by VulnCheck

CVE-2026-114110Astral uv before 0.11.6 Arbitrary File Deletion via Wheel RECORD Entries

Medium 5.3

In plain English

A medium-severity security flaw in uv from astral-sh. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 29% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)0.3%top 71.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Astral uv before 0.11.6 contains a path traversal vulnerability that allows attackers to delete arbitrary files by supplying wheels with relative traversal paths in RECORD entries. Attackers can craft a malicious wheel whose RECORD references files outside the installation prefix, causing uv to delete those files when the user uninstalls the package.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:14	uv	no fix listed	DEBIAN-CVE-2026-114110
PyPI	uv	0.11.6	GHSA-pjjw-68hj-v9mw
Ubuntu:26.10	uv	no fix listed	UBUNTU-CVE-2026-114110

Affected products (as reported)

Vendor	Product	Versions
astral-sh	uv	0 – before 0.11.6

Weakness: CWE-23 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

References

GitHub Security Advisory (GHSA-pjjw-68hj-v9mw) vendor-advisory
VulnCheck Advisory: Astral uv before 0.11.6 Arbitrary File Deletion via Wheel RECORD Entries third-party-advisory