uv 0.9.5 ZIP Parsing Differential RCE (CVE-2025-13327)

Critical Vulnerability Information Vulnerability ID: Bug 2407263 (CVE-2025-13327, GHSA-pqhf-p39g-3x64) Vulnerability Description: Specially crafted ZIP archives can lead to arbitrary code execution due to parsing differentials. Report Date: 2025-10-29 23:06 UTC Status: NEW Product: Security Response Component: vulnerability Version: unspecified OS: Linux Priority: medium Severity: medium Reporter: OSIDB Bzimport Impact ZIP Processing Issue: In versions 0.9.5 and earlier of , ZIP archives were handled in a way that enabled two parsing differentials against other components of the Python packaging ecosystem. - Central directory entries in a ZIP archive could contain comment fields, but would not interpret or process them. An attacker could leverage this by constructing a ZIP archive with specially crafted comment fields to exploit this vulnerability. - Both local file entries and central directory entries can contain filename fields. If these fields contain ASCII null bytes, Python's module truncates the filename at the first null byte. would not handle this consistently, leading to potential arbitrary code execution. Solution Upgrade Version: Users are advised to upgrade to version 0.9.6 or newer, which addresses both parsing differentials by properly handling comments in central directory entries and refusing to process ZIPs with unusual filename fields. Environment Variable: Users experiencing issues can set to revert to previous behavior.

Goal Reached Thanks to every supporter — we hit 100%!

uv 0.9.5 ZIP Parsing Differential RCE (CVE-2025-13327)