CVE-2025-13327

low-risk

Published 2026-02-27

A flaw was found in uv. This vulnerability allows an attacker to execute malicious code during package resolution or installation via specially crafted ZIP (Zipped Information Package) archives that exploit parsing differentials, requiring user interaction to install an attacker-controlled package.

Do I need to act?

0.01% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 6.3/10 Medium

LOCAL / HIGH complexity

Affected Products (1)

Affected Vendors

Astral

References (5)

Third Party Advisory https://access.redhat.com/security/cve/CVE-2025-13327

Issue Tracking https://bugzilla.redhat.com/show_bug.cgi?id=2407263

Product https://github.com/astral-sh/uv

Patch https://github.com/astral-sh/uv/commit/da659fee4898a73dbc75070f3e82d49f745e4628

Vendor Advisory https://github.com/astral-sh/uv/security/advisories/GHSA-pqhf-p39g-3x64

/ 100

low-risk

Severity 16/34 · Moderate

Exploitability 0/34 · Minimal

Exposure 5/34 · Minimal