Hi,

The following vulnerability was published for uv.

CVE-2026-114109[0]:
| uv before 0.11.15 contains a path traversal vulnerability that
| allows malicious wheels to write files outside the scripts directory
| via crafted console_scripts or gui_scripts entry point names.
| Attackers who induce users to install a malicious wheel can place
| executables in PATH directories, shadowing or overwriting existing
| binaries for code execution.

https://github.com/astral-sh/uv/security/advisories/GHSA-4gg8-gxpx-9rph


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-114109
https://www.cve.org/CVERecord?id=CVE-2026-114109

Please adjust the affected versions in the BTS as needed.