Astral uv before version 0.8.22 contains a path traversal flaw in the extraction of source distribution tarballs. A malicious creator can craft a sequence of symlinks inside the tar archive that, when uv extracts the package, causes files to be written outside the intended installation prefix. This allows an attacker to overwrite arbitrary files on the victim’s file system, potentially leading to code execution or privilege escalation if the overwritten files are executable binaries or configuration files used by privileged services.

The vulnerability affects all deployments of Astral uv up to and including 0.8.21, as well as any older releases that have not applied the 0.8.22 fix. Users who install packages through uv—particularly from public Python package indices—are exposed, regardless of the target operating system.

The CVSS base score of 8.7 signals a high severity flaw. The EPSS score is less than 1%, indicating a low but non-zero probability of exploitation; nevertheless, the ability to write arbitrary files means the impact could be severe. This issue is not listed in the CISA KEV catalog, but the vulnerability can be abused by simply running a malicious sdist, a common user action when installing packages with uv. Attacks would likely originate from compromised or malicious package registries or from untrusted third‑party distribution channels.