CVE-2025-71437 | CVSS: 6.5 | 严重级别: MEDIUM
Astral uv before 0.8.22 contains a path traversal vulnerability in source distribution (sdist) tar extraction that allows a specially crafted sequence of symlinks to redirect file writes outside the intended extraction prefix. Attackers can publish a malicious sdist that, when installed by a victim, writes arbitrary files to filesystem locations outside the installation prefix.
参考链接:
• https://github.com/astral-sh/uv/security/advisories/GHSA-7j9j-68r2-f35q
• https://www.vulncheck.com/advisories/astral-uv-through-0.8.21-path-traversal-via
📌 数据来源: NVD 官方
⚠️ 合规声明: 本文内容仅用于网络安全合规学习、科研与授权测试用途。严禁用于任何未授权行为,违者自行承担全部法律责任。