CVE-2025-13327
Uv: uv: specially crafted zip archives lead to arbitrary code execution due to parsing differentials
- State
- Published
- Severity
- 6.3 Medium
- Published
- Feb 27, 2026
- Updated
- Oct 29, 2026
- Reserved
- Nov 17, 2025
Description
A flaw was found in uv. This vulnerability allows an attacker to execute malicious code during package resolution or installation via specially crafted ZIP (Zipped Information Package) archives that exploit parsing differentials, requiring user interaction to install an attacker-controlled package.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 6.3 Medium | CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H | redhat |
Weaknesses
- CWE-1286 Improper Validation of Syntactic Correctness of Input
Affected Products
| Product | Versions |
|---|---|
uvastral-sh |
|
Red Hat OpenShift AI 3.0Red Hat |
|
Red Hat OpenShift AI 3.0Red Hat |
|
Red Hat OpenShift AI 3.0Red Hat |
|
Red Hat AI Inference ServerRed Hat | |
Red Hat AI Inference ServerRed Hat | |
Red Hat AI Inference ServerRed Hat | |
Red Hat AI Inference ServerRed Hat | |
Red Hat AI Inference ServerRed Hat | |
Red Hat AI Inference ServerRed Hat | |
Red Hat AI Inference ServerRed Hat | |
Red Hat OpenShift AI (RHOAI)Red Hat | |
Red Hat OpenShift AI (RHOAI)Red Hat | |
Red Hat OpenShift AI (RHOAI)Red Hat | |
Red Hat OpenShift AI (RHOAI)Red Hat | |
Red Hat OpenShift AI (RHOAI)Red Hat | |
Red Hat OpenShift AI (RHOAI)Red Hat | |
Red Hat OpenShift AI (RHOAI)Red Hat | |
Red Hat OpenShift AI (RHOAI)Red Hat | |
Red Hat OpenShift AI (RHOAI)Red Hat | |
Red Hat OpenShift AI (RHOAI)Red Hat | |
Red Hat OpenShift AI (RHOAI)Red Hat | |
Red Hat OpenShift AI (RHOAI)Red Hat | |
Red Hat OpenShift AI (RHOAI)Red Hat | |
Red Hat OpenShift AI (RHOAI)Red Hat | |
Red Hat OpenShift AI (RHOAI)Red Hat | |
Red Hat OpenShift AI (RHOAI)Red Hat | |
Red Hat OpenShift AI (RHOAI)Red Hat | |
Red Hat OpenShift AI (RHOAI)Red Hat | |
Red Hat OpenShift AI (RHOAI)Red Hat | |
Red Hat OpenShift AI (RHOAI)Red Hat |
References
- RHSA-2026:91219vendor-advisory
- RHSA-2026:91232vendor-advisory
- RHSA-2026:91236vendor-advisory
- https://access.redhat.com/security/cve/CVE-2025-13327vdb-entry
- RHBZ#2407263issue-tracking
- https://github.com/astral-sh/uv
- https://github.com/astral-sh/uv/commit/da659fee4898a73dbc75070f3e82d49f745e4628
- https://github.com/astral-sh/uv/security/advisories/GHSA-pqhf-p39g-3x64
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.