uv
An extremely fast Python package and project manager, written in Rust.
View on Github
Activity
- Latest release
- 3d ago
- Total releases
- 95
- Cadence
- ~3 days
- Last 12 months
- 93
Reach
- Downloads
- 53.5k
- Stars
- 91.3k
Details
- License
- MIT OR Apache-2.0
- First release
- May 08, 2025
| Version | Released | |
|---|---|---|
0.13.6
patch
|
0.13.6
patch
Dependencies (120)
+ 112 more
Changelog
Compare changes
|
|
0.13.5
patch
|
0.13.5
patch
Dependencies (120)
+ 112 more
Changelog
Compare changes
|
|
0.13.4
patch
|
0.13.4
patch
Dependencies (120)
+ 112 more
Changelog
Compare changes
|
|
0.13.3
patch
|
0.13.3
patch
Dependencies (120)
+ 112 more
Changelog
Compare changes
|
|
0.13.2
patch
|
0.13.2
patch
Dependencies (120)
+ 112 more
Changelog
Compare changes
|
|
0.13.1
patch
|
0.13.1
patch
Dependencies (121)
+ 113 more
Changelog
Compare changes
|
|
0.13.0
minor
|
0.13.0
minor
Dependencies (121)
+ 113 more
Changelog
Compare changes
|
|
0.12.24
patch
|
0.12.24
patch
Dependencies (121)
+ 113 more
Changelog
Compare changes
|
|
0.12.23
patch
|
0.12.23
patch
Dependencies (127)
+ 119 more
Changelog
Compare changes
|
|
0.12.22
patch
|
0.12.22
patch
Dependencies (127)
+ 119 more
Changelog
Compare changes
|
|
0.12.21
patch
|
0.12.21
patch
Dependencies (127)
+ 119 more
Changelog
Compare changes
|
|
0.12.20
patch
|
0.12.20
patch
Dependencies (127)
+ 119 more
Changelog
Compare changes
|
|
0.12.19
patch
|
0.12.19
patch
Dependencies (127)
+ 119 more
Changelog
Compare changes
|
|
0.12.18
patch
|
0.12.18
patch
Dependencies (127)
+ 119 more
Changelog
Compare changes
|
|
0.12.17
patch
1 CVE
CVE-2026-104843
GHSA-2cv4-cqwr-gwf7
PYSEC-2026-4305
Oct 05, 2026
uv: Path traversal on Windows through wheel extraction
Medium
Network
Low
None
ImpactIn versions of uv from 0.12.7 to 0.12.18 on Windows, uv could be induced into writing a file outside of the installation prefix during wheel installation. A malicious wheel could use this to place an executable outside of the intended environment, including in a directory already present on the user's PATH. This vulnerability only affects Windows hosts; no other platforms are affected. Patchesuv 0.12.18 and newer address this vulnerability. Users are encouraged to upgrade to 0.12.18. WorkaroundsThere is no workaround other than upgrading to uv 0.12.18. Fixed in
0.12.18
References
Updated Oct 15, 2026 · Source: OSV.dev |
0.12.17
patch
Dependencies (127)
+ 119 more
Changelog
Compare changes
|
|
0.12.16
patch
1 CVE
CVE-2026-104843
GHSA-2cv4-cqwr-gwf7
PYSEC-2026-4305
Oct 05, 2026
uv: Path traversal on Windows through wheel extraction
Medium
Network
Low
None
ImpactIn versions of uv from 0.12.7 to 0.12.18 on Windows, uv could be induced into writing a file outside of the installation prefix during wheel installation. A malicious wheel could use this to place an executable outside of the intended environment, including in a directory already present on the user's PATH. This vulnerability only affects Windows hosts; no other platforms are affected. Patchesuv 0.12.18 and newer address this vulnerability. Users are encouraged to upgrade to 0.12.18. WorkaroundsThere is no workaround other than upgrading to uv 0.12.18. Fixed in
0.12.18
References
Updated Oct 15, 2026 · Source: OSV.dev |
0.12.16
patch
Dependencies (127)
+ 119 more
Changelog
Compare changes
|
|
0.12.15
patch
1 CVE
CVE-2026-104843
GHSA-2cv4-cqwr-gwf7
PYSEC-2026-4305
Oct 05, 2026
uv: Path traversal on Windows through wheel extraction
Medium
Network
Low
None
ImpactIn versions of uv from 0.12.7 to 0.12.18 on Windows, uv could be induced into writing a file outside of the installation prefix during wheel installation. A malicious wheel could use this to place an executable outside of the intended environment, including in a directory already present on the user's PATH. This vulnerability only affects Windows hosts; no other platforms are affected. Patchesuv 0.12.18 and newer address this vulnerability. Users are encouraged to upgrade to 0.12.18. WorkaroundsThere is no workaround other than upgrading to uv 0.12.18. Fixed in
0.12.18
References
Updated Oct 15, 2026 · Source: OSV.dev |
0.12.15
patch
Dependencies (125)
+ 117 more
Changelog
Compare changes
|
|
0.12.14
patch
1 CVE
CVE-2026-104843
GHSA-2cv4-cqwr-gwf7
PYSEC-2026-4305
Oct 05, 2026
uv: Path traversal on Windows through wheel extraction
Medium
Network
Low
None
ImpactIn versions of uv from 0.12.7 to 0.12.18 on Windows, uv could be induced into writing a file outside of the installation prefix during wheel installation. A malicious wheel could use this to place an executable outside of the intended environment, including in a directory already present on the user's PATH. This vulnerability only affects Windows hosts; no other platforms are affected. Patchesuv 0.12.18 and newer address this vulnerability. Users are encouraged to upgrade to 0.12.18. WorkaroundsThere is no workaround other than upgrading to uv 0.12.18. Fixed in
0.12.18
References
Updated Oct 15, 2026 · Source: OSV.dev |
0.12.14
patch
Dependencies (125)
+ 117 more
Changelog
Compare changes
|
|
0.12.13
patch
1 CVE
CVE-2026-104843
GHSA-2cv4-cqwr-gwf7
PYSEC-2026-4305
Oct 05, 2026
uv: Path traversal on Windows through wheel extraction
Medium
Network
Low
None
ImpactIn versions of uv from 0.12.7 to 0.12.18 on Windows, uv could be induced into writing a file outside of the installation prefix during wheel installation. A malicious wheel could use this to place an executable outside of the intended environment, including in a directory already present on the user's PATH. This vulnerability only affects Windows hosts; no other platforms are affected. Patchesuv 0.12.18 and newer address this vulnerability. Users are encouraged to upgrade to 0.12.18. WorkaroundsThere is no workaround other than upgrading to uv 0.12.18. Fixed in
0.12.18
References
Updated Oct 15, 2026 · Source: OSV.dev |
0.12.13
patch
Dependencies (126)
+ 118 more
Changelog
Compare changes
|
|
0.12.12
patch
1 CVE
CVE-2026-104843
GHSA-2cv4-cqwr-gwf7
PYSEC-2026-4305
Oct 05, 2026
uv: Path traversal on Windows through wheel extraction
Medium
Network
Low
None
ImpactIn versions of uv from 0.12.7 to 0.12.18 on Windows, uv could be induced into writing a file outside of the installation prefix during wheel installation. A malicious wheel could use this to place an executable outside of the intended environment, including in a directory already present on the user's PATH. This vulnerability only affects Windows hosts; no other platforms are affected. Patchesuv 0.12.18 and newer address this vulnerability. Users are encouraged to upgrade to 0.12.18. WorkaroundsThere is no workaround other than upgrading to uv 0.12.18. Fixed in
0.12.18
References
Updated Oct 15, 2026 · Source: OSV.dev |
0.12.12
patch
Dependencies (126)
+ 118 more
Changelog
Compare changes
|
|
0.12.11
patch
1 CVE
CVE-2026-104843
GHSA-2cv4-cqwr-gwf7
PYSEC-2026-4305
Oct 05, 2026
uv: Path traversal on Windows through wheel extraction
Medium
Network
Low
None
ImpactIn versions of uv from 0.12.7 to 0.12.18 on Windows, uv could be induced into writing a file outside of the installation prefix during wheel installation. A malicious wheel could use this to place an executable outside of the intended environment, including in a directory already present on the user's PATH. This vulnerability only affects Windows hosts; no other platforms are affected. Patchesuv 0.12.18 and newer address this vulnerability. Users are encouraged to upgrade to 0.12.18. WorkaroundsThere is no workaround other than upgrading to uv 0.12.18. Fixed in
0.12.18
References
Updated Oct 15, 2026 · Source: OSV.dev |
0.12.11
patch
Dependencies (126)
+ 118 more
Changelog
Compare changes
|
|
0.12.10
patch
1 CVE
CVE-2026-104843
GHSA-2cv4-cqwr-gwf7
PYSEC-2026-4305
Oct 05, 2026
uv: Path traversal on Windows through wheel extraction
Medium
Network
Low
None
ImpactIn versions of uv from 0.12.7 to 0.12.18 on Windows, uv could be induced into writing a file outside of the installation prefix during wheel installation. A malicious wheel could use this to place an executable outside of the intended environment, including in a directory already present on the user's PATH. This vulnerability only affects Windows hosts; no other platforms are affected. Patchesuv 0.12.18 and newer address this vulnerability. Users are encouraged to upgrade to 0.12.18. WorkaroundsThere is no workaround other than upgrading to uv 0.12.18. Fixed in
0.12.18
References
Updated Oct 15, 2026 · Source: OSV.dev |
0.12.10
patch
Dependencies (126)
+ 118 more
Changelog
Compare changes
|
|
0.12.9
patch
1 CVE
CVE-2026-104843
GHSA-2cv4-cqwr-gwf7
PYSEC-2026-4305
Oct 05, 2026
uv: Path traversal on Windows through wheel extraction
Medium
Network
Low
None
ImpactIn versions of uv from 0.12.7 to 0.12.18 on Windows, uv could be induced into writing a file outside of the installation prefix during wheel installation. A malicious wheel could use this to place an executable outside of the intended environment, including in a directory already present on the user's PATH. This vulnerability only affects Windows hosts; no other platforms are affected. Patchesuv 0.12.18 and newer address this vulnerability. Users are encouraged to upgrade to 0.12.18. WorkaroundsThere is no workaround other than upgrading to uv 0.12.18. Fixed in
0.12.18
References
Updated Oct 15, 2026 · Source: OSV.dev |
0.12.9
patch
Dependencies (126)
+ 118 more
Changelog
Compare changes
|
|
0.12.8
patch
1 CVE
CVE-2026-104843
GHSA-2cv4-cqwr-gwf7
PYSEC-2026-4305
Oct 05, 2026
uv: Path traversal on Windows through wheel extraction
Medium
Network
Low
None
ImpactIn versions of uv from 0.12.7 to 0.12.18 on Windows, uv could be induced into writing a file outside of the installation prefix during wheel installation. A malicious wheel could use this to place an executable outside of the intended environment, including in a directory already present on the user's PATH. This vulnerability only affects Windows hosts; no other platforms are affected. Patchesuv 0.12.18 and newer address this vulnerability. Users are encouraged to upgrade to 0.12.18. WorkaroundsThere is no workaround other than upgrading to uv 0.12.18. Fixed in
0.12.18
References
Updated Oct 15, 2026 · Source: OSV.dev |
0.12.8
patch
Dependencies (126)
+ 118 more
Changelog
Compare changes
|
|
0.12.7
patch
1 CVE
CVE-2026-104843
GHSA-2cv4-cqwr-gwf7
PYSEC-2026-4305
Oct 05, 2026
uv: Path traversal on Windows through wheel extraction
Medium
Network
Low
None
ImpactIn versions of uv from 0.12.7 to 0.12.18 on Windows, uv could be induced into writing a file outside of the installation prefix during wheel installation. A malicious wheel could use this to place an executable outside of the intended environment, including in a directory already present on the user's PATH. This vulnerability only affects Windows hosts; no other platforms are affected. Patchesuv 0.12.18 and newer address this vulnerability. Users are encouraged to upgrade to 0.12.18. WorkaroundsThere is no workaround other than upgrading to uv 0.12.18. Fixed in
0.12.18
References
Updated Oct 15, 2026 · Source: OSV.dev |
0.12.7
patch
Dependencies (126)
+ 118 more
Changelog
Compare changes
|
|
0.12.6
patch
|
0.12.6
patch
Dependencies (131)
+ 123 more
Changelog
Compare changes
|
|
0.12.5
patch
|
0.12.5
patch
Dependencies (131)
+ 123 more
Changelog
Compare changes
|
|
0.12.4
patch
|
0.12.4
patch
Dependencies (131)
+ 123 more
Changelog
Compare changes
|
|
0.12.3
patch
|
0.12.3
patch
Dependencies (130)
+ 122 more
Changelog
Compare changes
|
|
0.12.2
patch
|
0.12.2
patch
Dependencies (130)
+ 122 more
Changelog
Compare changes
|
|
0.12.1
patch
|
0.12.1
patch
Dependencies (130)
+ 122 more
Changelog
Compare changes
|
|
0.12.0
minor
|
0.12.0
minor
Dependencies (129)
+ 121 more
Changelog
Compare changes
|
|
0.11.33
patch
|
0.11.33
patch
Dependencies (129)
+ 121 more
Changelog
Compare changes
|
|
0.11.32
patch
|
0.11.32
patch
Dependencies (129)
+ 121 more
Changelog
Compare changes
|
|
0.11.31
patch
|
0.11.31
patch
Dependencies (128)
+ 120 more
Changelog
Compare changes
|
|
0.11.30
patch
|
0.11.30
patch
Dependencies (128)
+ 120 more
Changelog
Compare changes
|
|
0.11.29
patch
|
0.11.29
patch
Dependencies (127)
+ 119 more
Changelog
Compare changes
|
|
0.11.28
patch
|
0.11.28
patch
Dependencies (127)
+ 119 more
Changelog
Compare changes
|
|
0.11.27
patch
|
0.11.27
patch
Dependencies (127)
+ 119 more
Changelog
Compare changes
|
|
0.11.26
patch
|
0.11.26
patch
Dependencies (127)
+ 119 more
Changelog
Compare changes
|
|
0.11.25
patch
|
0.11.25
patch
Dependencies (127)
+ 119 more
Changelog
Compare changes
|
|
0.11.24
patch
|
0.11.24
patch
Dependencies (126)
+ 118 more
Changelog
Compare changes
|
|
0.11.23
patch
|
0.11.23
patch
Dependencies (126)
+ 118 more
Changelog
Compare changes
|
|
0.11.22
patch
|
0.11.22
patch
Dependencies (126)
+ 118 more
Changelog
Compare changes
|
|
0.11.21
patch
|
0.11.21
patch
Dependencies (126)
+ 118 more
Changelog
Compare changes
|
|
0.11.19
patch
|
0.11.19
patch
Dependencies (127)
+ 119 more
Changelog
Compare changes
|
|
0.11.18
patch
|
0.11.18
patch
Dependencies (127)
+ 119 more
Changelog
Compare changes
|
|
0.11.17
patch
|
0.11.17
patch
Dependencies (127)
+ 119 more
Changelog
Compare changes
|
|
0.11.15
patch
|
0.11.15
patch
Dependencies (126)
+ 118 more
Changelog
Compare changes
|
|
0.11.14
patch
1 CVE
CVE-2026-114109
GHSA-4gg8-gxpx-9rph
May 29, 2026
uv is vulnerable to arbitrary file write through entry point names
Medium
ImpactIn versions of uv prior to 0.11.15, when installing a distribution containing an entry point specification (under A malicious wheel could use this to place an executable outside of the intended environment, including in a directory already present on the user's In order to exploit this vulnerability, the attacker must induce their target into installing a malicious wheel. Patchesuv 0.11.15 and newer address this vulnerability. Users are encouraged to upgrade to 0.11.15. WorkaroundsThere is no workaround other than upgrading to uv 0.11.15. Fixed in
0.11.15
References Updated Oct 21, 2026 · Source: OSV.dev |
0.11.14
patch
Dependencies (127)
+ 119 more
Changelog
Compare changes
|