| パッケージ | 影響を受けるバージョン | 修正済みバージョン |
|---|---|---|
| uv | ≥ 0.12.7, < 0.12.18 | 0.12.18 |
| uv | ≥ 0.12.7, < 0.12.18 | 0.12.18 |
In versions of uv from 0.12.7 to 0.12.18 on Windows, uv could be induced into writing a file outside of the installation prefix during wheel installation.
A malicious wheel could use this to place an executable outside of the intended environment, including in a directory already present on the user's PATH.
This vulnerability only affects Windows hosts; no other platforms are affected.
uv 0.12.18 and newer address this vulnerability. Users are encouraged to upgrade to 0.12.18.
There is no workaround other than upgrading to uv 0.12.18.
これらの製品をお使いですか？サイトをスキャンして、脆弱なバージョンが公開されていないか確認しましょう。
無料でサイトをスキャン