Astral-Sh
5 CVEs across 2 Astral-Sh products. Browse Astral-Sh vulnerabilities, severities, and proof-of-concept exploits.
Astral-Sh products with known CVEs
Astral-Sh CVEs — newest first| CVE | Severity | Score | Published | Summary |
|---|
CVE-2026-32766 | Medium | 5.3 | 2026-03-20 | astral-tokio-tar is a tar archive reading/writing library for async Rust. In versions 0.5.6 and earlier, malformed PAX extensions were silently skipped when pa… |
CVE-2025-13327 | Medium | 6.3 | 2026-02-27 | A flaw was found in uv. This vulnerability allows an attacker to execute malicious code during package resolution or installation via specially crafted ZIP (Zi… |
CVE-2025-62518 | High | 8.1 | 2025-10-21 | astral-tokio-tar is a tar archive reading/writing library for async Rust. Versions of astral-tokio-tar prior to 0.5.6 contain a boundary parsing vulnerability… |
CVE-2025-59825 | | | 2025-09-23 | astral-tokio-tar is a tar archive reading/writing library for async Rust. In versions 0.5.3 and earlier of astral-tokio-tar, tar archives may extract outside o… |
CVE-2025-54368 | | | 2025-08-08 | uv is a Python package and project manager written in Rust. In versions 0.8.5 and earlier, remote ZIP archives were handled in a streamwise fashion, and file e… |