Vulnerability PYSEC-2026-4321
Unknown
UNKNOWN RISK
Vulnerabilities without an assigned CVSS score. Severity is not determinable from available data.
5 hours ago
October 20, 2026 at 09:49 PM UTC
uv's bundled CA store trusts an emSign root whose intermediate CA keys are compromised
0.0.5 - 0.13.3
0.0.5 - 0.13.3
Summary
uv's bundled CA store trusts an emSign root whose intermediate CA keys are compromised
Details
By default, uv verifies TLS connections against a vendored copy of the webpki-root-certs bundle. Versions before 0.13.4 include the emSign ECC Root CA - G3 root. Eight eMudhra intermediate CA certificates that chain to that root have compromised private keys, and the CA has revoked them.
An attacker with one of the compromised keys can issue certificates that uv accepts for any hostname, and can be used to issue certificates to enable MITM attacks.
uv 0.13.4 removes the root from its vendored bundle, following webpki-root-certs 1.0.10. Upgrade to 0.13.4 or later.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Critical
7 hours ago
uv's bundled CA store trusts an emSign root whose intermediate CA keys are compromised
0.0.5 - 0.13.3 GHSA-hq85-5cpj-mr62
0.0.5 - 0.13.3 GHSA-hq85-5cpj-mr62
Unknown
5 days ago
uv: Path traversal on Windows through wheel extraction
0.12.7 - 0.12.17 PYSEC-2026-4305
0.12.7 - 0.12.17 PYSEC-2026-4305
Medium Risk
15 days ago
uv: Path traversal on Windows through wheel extraction
0.12.7 - 0.12.17 GHSA-2cv4-cqwr-gwf7
0.12.7 - 0.12.17 GHSA-2cv4-cqwr-gwf7
Unknown
3 months ago
uv allows ZIP payload obfuscation through parsing differentials
0.0.5 - 0.8.5 PYSEC-2026-2001
0.0.5 - 0.8.5 PYSEC-2026-2001
Medium Risk
4 months ago
uv is vulnerable to arbitrary file write through entry point names
0.0.5 - 0.11.14 GHSA-4gg8-gxpx-9rph
0.0.5 - 0.11.14 GHSA-4gg8-gxpx-9rph
Impacted packages
Timeline
Published
5 hours ago
October 20, 2026 at 09:49 PM UTC
Fixed (0.13.4)
12 hours ago
October 20, 2026 at 03:11 PM UTC
Last Modified
5 hours ago
October 20, 2026 at 10:00 PM UTC