Astral uv versions prior to 0.11.6 suffer from a path traversal flaw (CWE-22) that allows a user to delete arbitrary files by supplying wheel packages whose RECORD entries reference files outside the installation area. When such a malicious wheel is uninstalled, uv deletes those files, causing loss of critical data or system components. The vulnerability can compromise the integrity of the system and disrupt availability if essential files are removed.

The impacted product is Astral uv by astral‑sh. All releases before 0.11.6 are affected; users running any of those versions must verify their installed version and upgrade if necessary.

The CVSS score of 8.7 indicates high severity, and the EPSS value of < 1 % suggests that exploitation is currently uncommon but still possible. The vulnerability is not yet listed in the CISA KEV catalog. Attackers must craft a malicious wheel and trigger an uninstall; thus the attack vector is largely local or requires an attacker to influence a local package installation. Because the exploit relies on untrusted wheel content, systems that download or install wheels from third‑party sources are at higher risk.