CVE-2025-13327 Uv: uv: specially crafted zip archives lead to arbitrary code execution due to parsing differentials
A flaw was found in uv. This vulnerability allows an attacker to execute malicious code during package resolution or installation via specially crafted ZIP (Zipped Information Package) archives that exploit parsing differentials, requiring user interaction to install an attacker-controlled package.
Problem types: cwe_id: CWE-1286
description: Improper Validation of Syntactic Correctness of Input
Affected products: vendor: astral-sh
product: uv
default_status: unaffected
vendor: Red Hat
product: Red Hat AI Inference Server
cpes: cpe:/a:redhat:ai_inference_server:3
default_status: unaffected
vendor: Red Hat
product: Red Hat AI Inference Server
cpes: cpe:/a:redhat:ai_inference_server:3
default_status: unaffected
vendor: Red Hat
product: Red Hat AI Inference Server
cpes: cpe:/a:redhat:ai_inference_server:3
default_status: unaffected
vendor: Red Hat
product: Red Hat AI Inference Server
cpes: cpe:/a:redhat:ai_inference_server:3
default_status: affected
vendor: Red Hat
product: Red Hat AI Inference Server
cpes: cpe:/a:redhat:ai_inference_server:3
default_status: affected
vendor: Red Hat
product: Red Hat AI Inference Server
cpes: cpe:/a:redhat:ai_inference_server:3
default_status: affected
vendor: Red Hat
product: Red Hat AI Inference Server
cpes: cpe:/a:redhat:ai_inference_server:3
default_status: affected
vendor: Red Hat
product: Red Hat OpenShift AI (RHOAI)
cpes: cpe:/a:redhat:openshift_ai
default_status: affected
vendor: Red Hat
product: Red Hat OpenShift AI (RHOAI)
cpes: cpe:/a:redhat:openshift_ai
default_status: affected
vendor: Red Hat
product: Red Hat OpenShift AI (RHOAI)
cpes: cpe:/a:redhat:openshift_ai
default_status: affected
vendor: Red Hat
product: Red Hat OpenShift AI (RHOAI)
cpes: cpe:/a:redhat:openshift_ai
default_status: affected
vendor: Red Hat
product: Red Hat OpenShift AI (RHOAI)
cpes: cpe:/a:redhat:openshift_ai
default_status: affected
vendor: Red Hat
product: Red Hat OpenShift AI (RHOAI)
cpes: cpe:/a:redhat:openshift_ai
default_status: affected
vendor: Red Hat
product: Red Hat OpenShift AI (RHOAI)
cpes: cpe:/a:redhat:openshift_ai
default_status: affected
vendor: Red Hat
product: Red Hat OpenShift AI (RHOAI)
cpes: cpe:/a:redhat:openshift_ai
default_status: affected
vendor: Red Hat
product: Red Hat OpenShift AI (RHOAI)
cpes: cpe:/a:redhat:openshift_ai
default_status: affected
vendor: Red Hat
product: Red Hat OpenShift AI (RHOAI)
cpes: cpe:/a:redhat:openshift_ai
default_status: affected
vendor: Red Hat
product: Red Hat OpenShift AI (RHOAI)
cpes: cpe:/a:redhat:openshift_ai
default_status: affected
vendor: Red Hat
product: Red Hat OpenShift AI (RHOAI)
cpes: cpe:/a:redhat:openshift_ai
default_status: affected
vendor: Red Hat
product: Red Hat OpenShift AI (RHOAI)
cpes: cpe:/a:redhat:openshift_ai
default_status: affected
vendor: Red Hat
product: Red Hat OpenShift AI (RHOAI)
cpes: cpe:/a:redhat:openshift_ai
default_status: affected
vendor: Red Hat
product: Red Hat OpenShift AI (RHOAI)
cpes: cpe:/a:redhat:openshift_ai
default_status: affected
vendor: Red Hat
product: Red Hat OpenShift AI (RHOAI)
cpes: cpe:/a:redhat:openshift_ai
default_status: affected
vendor: Red Hat
product: Red Hat OpenShift AI (RHOAI)
cpes: cpe:/a:redhat:openshift_ai
default_status: affected
vendor: Red Hat
product: Red Hat OpenShift AI (RHOAI)
cpes: cpe:/a:redhat:openshift_ai
default_status: affected
vendor: Red Hat
product: Red Hat OpenShift AI (RHOAI)
cpes: cpe:/a:redhat:openshift_ai
default_status: affected
vendor: Red Hat
product: Red Hat OpenShift AI (RHOAI)
cpes: cpe:/a:redhat:openshift_ai
default_status: affected
CVSS v3.1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 6.3
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Published: 2026-02-27T07:30:20.131Z