Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
A flaw was found in uv. This vulnerability allows an attacker to execute malicious code during package resolution or installation via specially crafted ZIP (Zipped Information Package) archives that exploit parsing differentials, requiring user interaction to install an attacker-controlled package.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2025-13327 Arbitrary Code Execution in uv Package Manager via Malicious ZIP Archives https://vulmon.com/vulnerabilitydetails?qid=CVE-2025-13327
Post summary
The post announces CVE‑2025‑13327, a vulnerability in the uv package manager that allows arbitrary code execution through malicious ZIP archives, but does not provide any PoC, exploit code, active exploitation evidence, or patch details.
CVE-2025-13327 A flaw was found in uv. This vulnerability allows an attacker to execute malicious code during package resolution or installation via specially crafted ZIP (Zipped In… https://www.cve.org/CVERecord?id=CVE-2025-13327
Post summary
A vulnerability (CVE‑2025‑13327) in the uv package manager permits attackers to execute malicious code during package resolution or installation through specially crafted ZIP files.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | astral | uv | - | python | - |