Detections
Analytics
SCA: security update for uv (GHSA-8qf3-x8v5-2pj8)
medium Tenable Cloud Security Plugin ID 432557
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- uv is a Python package and project manager written in Rust. In versions 0.8.5 and earlier, remote ZIP
archives were handled in a streamwise fashion, and file entries were not reconciled against the archive's
central directory. An attacker could contrive a ZIP archive that would extract with legitimate contents on
some package installers, and malicious contents on others due to multiple local file entries. An attacker
could also contrive a "stacked" ZIP input with multiple internal ZIPs, which would be handled differently
by different package installers. The attacker could choose which installer to target in both scenarios.
This issue is fixed in version 0.8.6. To work around this issue, users may choose to set
UV_INSECURE_NO_ZIP_VALIDATION=1 to revert to the previous behavior. (CVE-2025-54368)
See Also
Plugin Details
Severity: Medium
ID: 432557
Version: Revision 1.8
Type: Local
Family: SCA Checks
Published: 8/8/2025
Updated: 7/2/2026
Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Low
Score: 3
Percentile: 23.92
Vendor
Vendor Severity: Medium
CVSS v2
Risk Factor: Medium
Base Score: 5.8
Temporal Score: 4.3
Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:N
CVSS Score Source: CVE-2025-54368
CVSS v3
Risk Factor: Medium
Base Score: 5.5
Temporal Score: 4.8
Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
CVSS v4
Risk Factor: Medium
Base Score: 6.8
Threat Score: 4.3
Threat Vector: CVSS:4.0/E:U
Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Vulnerability Information
Exploit Ease: No known exploits are available
Patch Publication Date: 8/7/2025
Vulnerability Publication Date: 8/7/2025
Reference Information
CVE: CVE-2025-54368