CVE-2025-13327
uv has ZIP payload obfuscation through parsing differentials
6.3
MEDIUM
CVSS 3.1
EPSS 0.01%
Description
A flaw was found in uv. This vulnerability allows an attacker to execute malicious code during package resolution or installation via specially crafted ZIP (Zipped Information Package) archives that exploit parsing differentials, requiring user interaction to install an attacker-controlled package.
How to fix CVE-2025-13327
To remediate CVE-2025-13327, upgrade the affected package to a fixed version below.
- —upgrade to 0.9.6 or later
- —upgrade to 0.9.6 or later
Is CVE-2025-13327 being exploited?
Low — EPSS is 0.0%, meaning exploitation activity has not been observed at scale.
Affected packages (2)
- from 0, < 0.9.6
- from 0, < 0.9.6
CVSS scores
| Source | Version | Severity | Vector |
|---|---|---|---|
| osv | CVSS 4.0 | — | CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N |
| osv | CVSS 3.1 | MEDIUM6.3 | CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H |