{"affected":[{"defaultStatus":"unaffected","ecosystem":"https://github.com/astral-sh/uv","packageName":"uv","product":"uv","source":"CNA: redhat","vendor":"astral-sh","versions":[{"lessThan":"0.9.6","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"affected","ecosystem":"https://catalog.redhat.com/software/containers/","packageName":"rhai/base-image-rocm-rhel9","product":"Red Hat OpenShift AI 3.0","source":"CNA: redhat","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793041981","versionType":"rpm"}]},{"defaultStatus":"affected","ecosystem":"https://catalog.redhat.com/software/containers/","packageName":"rhai/base-image-cpu-rhel9","product":"Red Hat OpenShift AI 3.0","source":"CNA: redhat","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793042072","versionType":"rpm"}]},{"defaultStatus":"affected","ecosystem":"https://catalog.redhat.com/software/containers/","packageName":"rhai/base-image-cuda-rhel9","product":"Red Hat OpenShift AI 3.0","source":"CNA: redhat","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793042067","versionType":"rpm"}]},{"defaultStatus":"affected","ecosystem":"https://catalog.redhat.com/software/containers/","packageName":"rhai/base-image-cpu-rhel9","product":"Red Hat OpenShift AI 3.0","source":"CNA: redhat","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793329709","versionType":"rpm"}]},{"defaultStatus":"unaffected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rhai/base-image-cpu-rhel9","product":"Red Hat AI Inference Server","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"unaffected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rhai/base-image-cuda-rhel9","product":"Red Hat AI Inference Server","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"unaffected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rhai/base-image-rocm-rhel9","product":"Red Hat AI Inference Server","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rhaiis/model-opt-cuda-rhel9","product":"Red Hat AI Inference Server","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rhaiis-preview/vllm-cuda-rhel9","product":"Red Hat AI Inference Server","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rhaiis/vllm-cuda-rhel9","product":"Red Hat AI Inference Server","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rhaiis/vllm-rocm-rhel9","product":"Red Hat AI Inference Server","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rhoai/odh-pipeline-runtime-datascience-cpu-py312-rhel9","product":"Red Hat OpenShift AI (RHOAI)","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rhoai/odh-pipeline-runtime-minimal-cpu-py312-rhel9","product":"Red Hat OpenShift AI (RHOAI)","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rhoai/odh-pipeline-runtime-pytorch-cuda-py312-rhel9","product":"Red Hat OpenShift AI (RHOAI)","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rhoai/odh-pipeline-runtime-pytorch-llmcompressor-cuda-py312-rhel9","product":"Red Hat OpenShift AI (RHOAI)","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rhoai/odh-pipeline-runtime-pytorch-rocm-py312-rhel9","product":"Red Hat OpenShift AI (RHOAI)","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rhoai/odh-pipeline-runtime-tensorflow-cuda-py312-rhel9","product":"Red Hat OpenShift AI (RHOAI)","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rhoai/odh-pipeline-runtime-tensorflow-rocm-py312-rhel9","product":"Red Hat OpenShift AI (RHOAI)","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rhoai/odh-training-rocm64-torch28-py312-rhel9","product":"Red Hat OpenShift AI (RHOAI)","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rhoai/odh-vllm-cpu-rhel9","product":"Red Hat OpenShift AI (RHOAI)","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9","product":"Red Hat OpenShift AI (RHOAI)","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rhoai/odh-workbench-jupyter-datascience-cpu-py312-rhel9","product":"Red Hat OpenShift AI (RHOAI)","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rhoai/odh-workbench-jupyter-minimal-cpu-py312-rhel9","product":"Red Hat OpenShift AI (RHOAI)","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rhoai/odh-workbench-jupyter-minimal-cuda-py312-rhel9","product":"Red Hat OpenShift AI (RHOAI)","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rhoai/odh-workbench-jupyter-minimal-rocm-py312-rhel9","product":"Red Hat OpenShift AI (RHOAI)","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rhoai/odh-workbench-jupyter-pytorch-cuda-py312-rhel9","product":"Red Hat OpenShift AI (RHOAI)","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rhoai/odh-workbench-jupyter-pytorch-llmcompressor-cuda-py312-rhel9","product":"Red Hat OpenShift AI (RHOAI)","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rhoai/odh-workbench-jupyter-pytorch-rocm-py312-rhel9","product":"Red Hat OpenShift AI (RHOAI)","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rhoai/odh-workbench-jupyter-tensorflow-cuda-py312-rhel9","product":"Red Hat OpenShift AI (RHOAI)","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rhoai/odh-workbench-jupyter-tensorflow-rocm-py312-rhel9","product":"Red Hat OpenShift AI (RHOAI)","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rhoai/odh-workbench-jupyter-trustyai-cpu-py312-rhel9","product":"Red Hat OpenShift AI (RHOAI)","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"unaffected","ecosystem":"PyPI","packageName":"uv","product":"uv","source":"OSV GHSA-pqhf-p39g-3x64","vendor":"","versions":[{"status":"affected","version":"0.0.5","versionType":"PyPI"},{"status":"affected","version":"0.1.0","versionType":"PyPI"},{"status":"affected","version":"0.1.1","versionType":"PyPI"},{"status":"affected","version":"0.1.10","versionType":"PyPI"},{"status":"affected","version":"0.1.11","versionType":"PyPI"},{"status":"affected","version":"0.1.12","versionType":"PyPI"},{"status":"affected","version":"0.1.13","versionType":"PyPI"},{"status":"affected","version":"0.1.14","versionType":"PyPI"},{"status":"affected","version":"0.1.15","versionType":"PyPI"},{"status":"affected","version":"0.1.16","versionType":"PyPI"},{"status":"affected","version":"0.1.17","versionType":"PyPI"},{"status":"affected","version":"0.1.18","versionType":"PyPI"},{"status":"affected","version":"0.1.19","versionType":"PyPI"},{"status":"affected","version":"0.1.2","versionType":"PyPI"},{"status":"affected","version":"0.1.20","versionType":"PyPI"},{"status":"affected","version":"0.1.21","versionType":"PyPI"},{"status":"affected","version":"0.1.22","versionType":"PyPI"},{"status":"affected","version":"0.1.23","versionType":"PyPI"},{"status":"affected","version":"0.1.24","versionType":"PyPI"},{"status":"affected","version":"0.1.25","versionType":"PyPI"},{"status":"affected","version":"0.1.26","versionType":"PyPI"},{"status":"affected","version":"0.1.27","versionType":"PyPI"},{"status":"affected","version":"0.1.28","versionType":"PyPI"},{"status":"affected","version":"0.1.29","versionType":"PyPI"},{"status":"affected","version":"0.1.3","versionType":"PyPI"},{"status":"affected","version":"0.1.30","versionType":"PyPI"},{"status":"affected","version":"0.1.31","versionType":"PyPI"},{"status":"affected","version":"0.1.32","versionType":"PyPI"},{"status":"affected","version":"0.1.33","versionType":"PyPI"},{"status":"affected","version":"0.1.34","versionType":"PyPI"},{"status":"affected","version":"0.1.35","versionType":"PyPI"},{"status":"affected","version":"0.1.36","versionType":"PyPI"},{"status":"affected","version":"0.1.37","versionType":"PyPI"},{"status":"affected","version":"0.1.38","versionType":"PyPI"},{"status":"affected","version":"0.1.39","versionType":"PyPI"},{"status":"affected","version":"0.1.4","versionType":"PyPI"},{"status":"affected","version":"0.1.40","versionType":"PyPI"},{"status":"affected","version":"0.1.41","versionType":"PyPI"},{"status":"affected","version":"0.1.42","versionType":"PyPI"},{"status":"affected","version":"0.1.43","versionType":"PyPI"},{"status":"affected","version":"0.1.44","versionType":"PyPI"},{"status":"affected","version":"0.1.45","versionType":"PyPI"},{"status":"affected","version":"0.1.5","versionType":"PyPI"},{"status":"affected","version":"0.1.6","versionType":"PyPI"},{"status":"affected","version":"0.1.7","versionType":"PyPI"},{"status":"affected","version":"0.1.8","versionType":"PyPI"},{"status":"affected","version":"0.1.9","versionType":"PyPI"},{"status":"affected","version":"0.2.0","versionType":"PyPI"},{"status":"affected","version":"0.2.1","versionType":"PyPI"},{"status":"affected","version":"0.2.10","versionType":"PyPI"},{"status":"affected","version":"0.2.11","versionType":"PyPI"},{"status":"affected","version":"0.2.12","versionType":"PyPI"},{"status":"affected","version":"0.2.13","versionType":"PyPI"},{"status":"affected","version":"0.2.14","versionType":"PyPI"},{"status":"affected","version":"0.2.15","versionType":"PyPI"},{"status":"affected","version":"0.2.16","versionType":"PyPI"},{"status":"affected","version":"0.2.17","versionType":"PyPI"},{"status":"affected","version":"0.2.18","versionType":"PyPI"},{"status":"affected","version":"0.2.19","versionType":"PyPI"},{"status":"affected","version":"0.2.2","versionType":"PyPI"},{"status":"affected","version":"0.2.20","versionType":"PyPI"},{"status":"affected","version":"0.2.21","versionType":"PyPI"},{"status":"affected","version":"0.2.22","versionType":"PyPI"},{"status":"affected","version":"0.2.23","versionType":"PyPI"},{"status":"affected","version":"0.2.24","versionType":"PyPI"},{"status":"affected","version":"0.2.25","versionType":"PyPI"},{"status":"affected","version":"0.2.26","versionType":"PyPI"},{"status":"affected","version":"0.2.27","versionType":"PyPI"},{"status":"affected","version":"0.2.28","versionType":"PyPI"},{"status":"affected","version":"0.2.29","versionType":"PyPI"},{"status":"affected","version":"0.2.3","versionType":"PyPI"},{"status":"affected","version":"0.2.30","versionType":"PyPI"},{"status":"affected","version":"0.2.31","versionType":"PyPI"},{"status":"affected","version":"0.2.32","versionType":"PyPI"},{"status":"affected","version":"0.2.33","versionType":"PyPI"},{"status":"affected","version":"0.2.34","versionType":"PyPI"},{"status":"affected","version":"0.2.35","versionType":"PyPI"},{"status":"affected","version":"0.2.36","versionType":"PyPI"},{"status":"affected","version":"0.2.37","versionType":"PyPI"},{"status":"affected","version":"0.2.4","versionType":"PyPI"},{"status":"affected","version":"0.2.5","versionType":"PyPI"},{"status":"affected","version":"0.2.6","versionType":"PyPI"},{"status":"affected","version":"0.2.7","versionType":"PyPI"},{"status":"affected","version":"0.2.8","versionType":"PyPI"},{"status":"affected","version":"0.2.9","versionType":"PyPI"},{"status":"affected","version":"0.3.0","versionType":"PyPI"},{"status":"affected","version":"0.3.1","versionType":"PyPI"},{"status":"affected","version":"0.3.2","versionType":"PyPI"},{"status":"affected","version":"0.3.3","versionType":"PyPI"},{"status":"affected","version":"0.3.4","versionType":"PyPI"},{"status":"affected","version":"0.3.5","versionType":"PyPI"},{"status":"affected","version":"0.4.0","versionType":"PyPI"},{"status":"affected","version":"0.4.1","versionType":"PyPI"},{"status":"affected","version":"0.4.10","versionType":"PyPI"},{"status":"affected","version":"0.4.11","versionType":"PyPI"},{"status":"affected","version":"0.4.12","versionType":"PyPI"},{"status":"affected","version":"0.4.13","versionType":"PyPI"},{"status":"affected","version":"0.4.14","versionType":"PyPI"},{"status":"affected","version":"0.4.15","versionType":"PyPI"},{"status":"affected","version":"0.4.16","versionType":"PyPI"},{"status":"affected","version":"0.4.17","versionType":"PyPI"},{"status":"affected","version":"0.4.18","versionType":"PyPI"},{"status":"affected","version":"0.4.19","versionType":"PyPI"},{"status":"affected","version":"0.4.2","versionType":"PyPI"},{"status":"affected","version":"0.4.20","versionType":"PyPI"},{"status":"affected","version":"0.4.21","versionType":"PyPI"},{"status":"affected","version":"0.4.22","versionType":"PyPI"},{"status":"affected","version":"0.4.23","versionType":"PyPI"},{"status":"affected","version":"0.4.24","versionType":"PyPI"},{"status":"affected","version":"0.4.25","versionType":"PyPI"},{"status":"affected","version":"0.4.26","versionType":"PyPI"},{"status":"affected","version":"0.4.27","versionType":"PyPI"},{"status":"affected","version":"0.4.28","versionType":"PyPI"},{"status":"affected","version":"0.4.29","versionType":"PyPI"},{"status":"affected","version":"0.4.3","versionType":"PyPI"},{"status":"affected","version":"0.4.30","versionType":"PyPI"},{"status":"affected","version":"0.4.4","versionType":"PyPI"},{"status":"affected","version":"0.4.5","versionType":"PyPI"},{"status":"affected","version":"0.4.6","versionType":"PyPI"},{"status":"affected","version":"0.4.7","versionType":"PyPI"},{"status":"affected","version":"0.4.8","versionType":"PyPI"},{"status":"affected","version":"0.4.9","versionType":"PyPI"},{"status":"affected","version":"0.5.0","versionType":"PyPI"},{"status":"affected","version":"0.5.1","versionType":"PyPI"},{"status":"affected","version":"0.5.10","versionType":"PyPI"},{"status":"affected","version":"0.5.11","versionType":"PyPI"},{"status":"affected","version":"0.5.12","versionType":"PyPI"},{"status":"affected","version":"0.5.13","versionType":"PyPI"},{"status":"affected","version":"0.5.14","versionType":"PyPI"},{"status":"affected","version":"0.5.15","versionType":"PyPI"},{"status":"affected","version":"0.5.16","versionType":"PyPI"},{"status":"affected","version":"0.5.17","versionType":"PyPI"},{"status":"affected","version":"0.5.18","versionType":"PyPI"},{"status":"affected","version":"0.5.19","versionType":"PyPI"},{"status":"affected","version":"0.5.2","versionType":"PyPI"},{"status":"affected","version":"0.5.20","versionType":"PyPI"},{"status":"affected","version":"0.5.21","versionType":"PyPI"},{"status":"affected","version":"0.5.22","versionType":"PyPI"},{"status":"affected","version":"0.5.23","versionType":"PyPI"},{"status":"affected","version":"0.5.24","versionType":"PyPI"},{"status":"affected","version":"0.5.25","versionType":"PyPI"},{"status":"affected","version":"0.5.26","versionType":"PyPI"},{"status":"affected","version":"0.5.27","versionType":"PyPI"},{"status":"affected","version":"0.5.28","versionType":"PyPI"},{"status":"affected","version":"0.5.29","versionType":"PyPI"},{"status":"affected","version":"0.5.3","versionType":"PyPI"},{"status":"affected","version":"0.5.30","versionType":"PyPI"},{"status":"affected","version":"0.5.31","versionType":"PyPI"},{"status":"affected","version":"0.5.4","versionType":"PyPI"},{"status":"affected","version":"0.5.5","versionType":"PyPI"},{"status":"affected","version":"0.5.6","versionType":"PyPI"},{"status":"affected","version":"0.5.7","versionType":"PyPI"},{"status":"affected","version":"0.5.8","versionType":"PyPI"},{"status":"affected","version":"0.5.9","versionType":"PyPI"},{"status":"affected","version":"0.6.0","versionType":"PyPI"},{"status":"affected","version":"0.6.1","versionType":"PyPI"},{"status":"affected","version":"0.6.10","versionType":"PyPI"},{"status":"affected","version":"0.6.11","versionType":"PyPI"},{"status":"affected","version":"0.6.12","versionType":"PyPI"},{"status":"affected","version":"0.6.13","versionType":"PyPI"},{"status":"affected","version":"0.6.14","versionType":"PyPI"},{"status":"affected","version":"0.6.15","versionType":"PyPI"},{"status":"affected","version":"0.6.16","versionType":"PyPI"},{"status":"affected","version":"0.6.17","versionType":"PyPI"},{"status":"affected","version":"0.6.2","versionType":"PyPI"},{"status":"affected","version":"0.6.3","versionType":"PyPI"},{"status":"affected","version":"0.6.4","versionType":"PyPI"},{"status":"affected","version":"0.6.5","versionType":"PyPI"},{"status":"affected","version":"0.6.6","versionType":"PyPI"},{"status":"affected","version":"0.6.7","versionType":"PyPI"},{"status":"affected","version":"0.6.8","versionType":"PyPI"},{"status":"affected","version":"0.6.9","versionType":"PyPI"},{"status":"affected","version":"0.7.0","versionType":"PyPI"},{"status":"affected","version":"0.7.1","versionType":"PyPI"},{"status":"affected","version":"0.7.10","versionType":"PyPI"},{"status":"affected","version":"0.7.11","versionType":"PyPI"},{"status":"affected","version":"0.7.12","versionType":"PyPI"},{"status":"affected","version":"0.7.13","versionType":"PyPI"},{"status":"affected","version":"0.7.14","versionType":"PyPI"},{"status":"affected","version":"0.7.15","versionType":"PyPI"},{"status":"affected","version":"0.7.16","versionType":"PyPI"},{"status":"affected","version":"0.7.17","versionType":"PyPI"},{"status":"affected","version":"0.7.18","versionType":"PyPI"},{"status":"affected","version":"0.7.19","versionType":"PyPI"},{"status":"affected","version":"0.7.2","versionType":"PyPI"},{"status":"affected","version":"0.7.20","versionType":"PyPI"},{"status":"affected","version":"0.7.21","versionType":"PyPI"},{"status":"affected","version":"0.7.22","versionType":"PyPI"},{"status":"affected","version":"0.7.3","versionType":"PyPI"},{"status":"affected","version":"0.7.4","versionType":"PyPI"},{"status":"affected","version":"0.7.5","versionType":"PyPI"},{"status":"affected","version":"0.7.6","versionType":"PyPI"},{"status":"affected","version":"0.7.7","versionType":"PyPI"},{"status":"affected","version":"0.7.8","versionType":"PyPI"},{"status":"affected","version":"0.7.9","versionType":"PyPI"},{"status":"affected","version":"0.8.0","versionType":"PyPI"},{"status":"affected","version":"0.8.1","versionType":"PyPI"},{"status":"affected","version":"0.8.10","versionType":"PyPI"},{"status":"affected","version":"0.8.11","versionType":"PyPI"},{"status":"affected","version":"0.8.12","versionType":"PyPI"},{"status":"affected","version":"0.8.13","versionType":"PyPI"},{"status":"affected","version":"0.8.14","versionType":"PyPI"},{"status":"affected","version":"0.8.15","versionType":"PyPI"},{"status":"affected","version":"0.8.16","versionType":"PyPI"},{"status":"affected","version":"0.8.17","versionType":"PyPI"},{"status":"affected","version":"0.8.18","versionType":"PyPI"},{"status":"affected","version":"0.8.19","versionType":"PyPI"},{"status":"affected","version":"0.8.2","versionType":"PyPI"},{"status":"affected","version":"0.8.20","versionType":"PyPI"},{"status":"affected","version":"0.8.21","versionType":"PyPI"},{"status":"affected","version":"0.8.22","versionType":"PyPI"},{"status":"affected","version":"0.8.23","versionType":"PyPI"},{"status":"affected","version":"0.8.24","versionType":"PyPI"},{"status":"affected","version":"0.8.3","versionType":"PyPI"},{"status":"affected","version":"0.8.4","versionType":"PyPI"},{"status":"affected","version":"0.8.5","versionType":"PyPI"},{"status":"affected","version":"0.8.6","versionType":"PyPI"},{"status":"affected","version":"0.8.7","versionType":"PyPI"},{"status":"affected","version":"0.8.8","versionType":"PyPI"},{"status":"affected","version":"0.8.9","versionType":"PyPI"},{"status":"affected","version":"0.9.0","versionType":"PyPI"},{"status":"affected","version":"0.9.1","versionType":"PyPI"},{"status":"affected","version":"0.9.2","versionType":"PyPI"},{"status":"affected","version":"0.9.3","versionType":"PyPI"},{"status":"affected","version":"0.9.4","versionType":"PyPI"},{"status":"affected","version":"0.9.5","versionType":"PyPI"},{"events":[{"introduced":"0"},{"fixed":"0.9.6"}],"status":"unknown","version":"0","versionType":"ECOSYSTEM"}]}],"cpeConfigurations":[{"negate":false,"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:astral:uv:*:*:*:*:*:python:*:*","versionEndExcluding":"0.9.6","vulnerable":true}],"negate":false,"operator":"OR"}],"operator":"OR"}],"cveId":"CVE-2025-13327","cwes":["CWE-1286"],"description":"A flaw was found in uv. This vulnerability allows an attacker to execute malicious code during package resolution or installation via specially crafted ZIP (Zipped Information Package) archives that exploit parsing differentials, requiring user interaction to install an attacker-controlled package.","epss":{"date":"2026-11-02","percentile":0.06543,"score":0.00172},"exploits":[],"kev":null,"metrics":[{"score":6.3,"severity":"medium","source":"CNA: redhat","vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},{"score":6.3,"severity":"medium","source":"NVD: nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},{"score":6.3,"severity":"medium","source":"NVD: secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H","version":"3.1"}],"modifiedAt":1793701032997,"publishedAt":1772177420131,"references":[{"source":"CNA: redhat","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2026:91219"},{"source":"CNA: redhat","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2026:91232"},{"source":"CNA: redhat","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2026:91236"},{"source":"CNA: redhat","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2026:94459"},{"source":"CNA: redhat","tags":["vdb-entry","x_refsource_REDHAT"],"url":"https://access.redhat.com/security/cve/CVE-2025-13327"},{"source":"CNA: redhat","tags":["issue-tracking","x_refsource_REDHAT"],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2407263"},{"source":"CNA: redhat","tags":[],"url":"https://github.com/astral-sh/uv"},{"source":"CNA: redhat","tags":[],"url":"https://github.com/astral-sh/uv/commit/da659fee4898a73dbc75070f3e82d49f745e4628"},{"source":"CNA: redhat","tags":[],"url":"https://github.com/astral-sh/uv/security/advisories/GHSA-pqhf-p39g-3x64"},{"source":"secalert@redhat.com","tags":[],"url":"https://access.redhat.com/errata/RHSA-2026:91219"},{"source":"secalert@redhat.com","tags":[],"url":"https://access.redhat.com/errata/RHSA-2026:91232"},{"source":"secalert@redhat.com","tags":[],"url":"https://access.redhat.com/errata/RHSA-2026:91236"},{"source":"secalert@redhat.com","tags":[],"url":"https://access.redhat.com/errata/RHSA-2026:94459"},{"source":"secalert@redhat.com","tags":["Third Party Advisory"],"url":"https://access.redhat.com/security/cve/CVE-2025-13327"},{"source":"secalert@redhat.com","tags":["Issue Tracking"],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2407263"},{"source":"secalert@redhat.com","tags":["Product"],"url":"https://github.com/astral-sh/uv"},{"source":"secalert@redhat.com","tags":["Patch"],"url":"https://github.com/astral-sh/uv/commit/da659fee4898a73dbc75070f3e82d49f745e4628"},{"source":"secalert@redhat.com","tags":["Vendor Advisory"],"url":"https://github.com/astral-sh/uv/security/advisories/GHSA-pqhf-p39g-3x64"},{"source":"OSV / GitHub Security Advisories","tags":["advisory"],"url":"https://github.com/advisories/GHSA-pqhf-p39g-3x64"},{"source":"OSV / GitHub Security Advisories","tags":["osv"],"url":"https://osv.dev/vulnerability/GHSA-pqhf-p39g-3x64"}],"remediation":[{"kind":"workaround","source":"CNA: redhat","text":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."},{"kind":"fix","source":"secalert@redhat.com","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://github.com/astral-sh/uv/commit/da659fee4898a73dbc75070f3e82d49f745e4628"},{"kind":"fix","source":"OSV GHSA-pqhf-p39g-3x64","text":"uv (PyPI): OSV reports a fixed version 0.9.6. Check the advisory for supported release branches.","url":"https://github.com/advisories/GHSA-pqhf-p39g-3x64"}],"revision":"00b062c88c0d1d4982b1a126c532b1d21adcfb3902d294997f1b8dbb214af878","sources":[{"modifiedAt":1793699996210,"name":"CNA: redhat","retrievedAt":1793700502404,"url":"https://www.cve.org/CVERecord?id=CVE-2025-13327"},{"modifiedAt":1793701032997,"name":"NVD","retrievedAt":1793708152670,"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-13327"},{"modifiedAt":1783927608000,"name":"OSV / GitHub Security Advisories","retrievedAt":1793700503202,"url":"https://osv.dev/vulnerability/GHSA-pqhf-p39g-3x64"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793700530250,"url":"https://api.first.org/data/v1/epss?cve=CVE-2025-13327"}],"ssvc":{"assessedAt":1772567174125,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"total"},"status":"published","title":"Uv: uv: specially crafted zip archives lead to arbitrary code execution due to parsing differentials","updatedAt":1793708152670}