Is CVE-2026-114110 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-114110?

CVE-2026-114110 has a CVSS v3 severity of MEDIUM (5.3).

Back

CVE-2026-114110

Description

Astral uv before 0.11.6 contains a path traversal vulnerability that allows attackers to delete arbitrary files by supplying wheels with relative traversal paths in RECORD entries. Attackers can craft a malicious wheel whose RECORD references files outside the installation prefix, causing uv to delete those files when the user uninstalls the package.