Skip to content
Fencer Intel
low —

GHSA-w476-p2h3-79g9 json

uv has differential in tar extraction with PAX headers

published last yr. modified 9mo ago

cvss
—
not scored
cisa kev
Not listed
not in CISA's catalog
epss
—
no score, EPSS covers CVEs only
public exploits
0
none known

Summary

### Impact

In versions 0.9.4 and earlier of uv, tar archives containing PAX headers with file size overrides were not handled properly. As a result, an attacker could contrive a source distribution (as a tar archive) that would extract differently when installed via uv versus other Python package installers.

The underlying parsing differential here originates with astral-tokio-tar, which disclosed this vulnerability as CVE-2025-62518.

In practice, the impact of this vulnerability is **low**: only source distributions can be formatted as tar archives, and source distributions execute arbitrary code at build/installation time by definition. Consequently, a parser differential in tar extraction is strictly less powerful than the capabilities already exposed to an attacker who has the ability to control source distributions.

However, this particular source of malleability in source distributions is unintentional and not operating by design, and therefore we consider it a vulnerability despite its overlap in capabilities with intended behavior.

### Patches

Versions 0.9.5 and newer of uv address the vulnerability above. Users should upgrade to 0.9.5 or newer.

### Workarounds

Users are advised to upgrade to version 0.9.5 or newer to address this advisory.

Users should experience no breaking changes as a result of the patch above.

### References

* See CVE-2025-62518 for the corresponding advisory against astral-tokio-tar

Patch / fix

  • pypi uv 0.9.5

Is GHSA-w476-p2h3-79g9 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Affected packages

ecosystem package affected fixed in
pypi uv
<0.9.5
0.9.5

Classification

Weakness
  • CWE-843 Access of Resource Using Incompatible Type

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

The maintainers of astral-sh/uv published their own advisory on GitHub. Reviewed sources take precedence over it.