9.1

GHSA-HQ85-5CPJ-MR62: uv PyPI

CVSS: 9.1v4.0CriticalPublished
AliasesPYSEC-2026-4321
Published 20-10-2026Last modified 20-10-2026
Open JSON

Vulnerability summary

GHSA-HQ85-5CPJ-MR62 is a critical (CVSS 9.1) vulnerability in uv PyPI.

Overall risk
70/100
0100
High · default modelHow is this calculated?
CVSS score
9.1/10
010
Critical · v4.0 (OSV · Pypi), selected by version preference
EPSS score
Not scored
0%100%
No EPSS score yet
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Timeline

  1. 20-10-2026
    PublishedVulnerability first disclosed.
  2. 20-10-2026
    Last modifiedVulnerability information updated.

Description

uv's bundled CA store trusts an emSign root whose intermediate CA keys are compromised By default, uv verifies TLS connections against a vendored copy of the `webpki-root-certs` bundle. Versions before 0.13.4 include the `emSign ECC Root CA - G3` root. Eight eMudhra intermediate CA certificates that chain to that root have compromised private keys, and the CA has revoked them. An attacker with one of the compromised keys can issue certificates that uv accepts for any hostname, and can be used to issue certificates to enable MITM attacks. uv 0.13.4 removes the root from its vendored bundle, following `webpki-root-certs` 1.0.10. Upgrade to 0.13.4 or later.

CVSS metrics

1 score · 1 source · 1 version

EPSS trend

No EPSS score has been published for this record yet.

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

PyPI1 product
  • uv< 0.13.4

1 vendor · 1 product

References

7 links