{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/uv--0.13.4/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["uv (\u003c 0.13.4)"],"_cs_severities":["critical"],"_cs_tags":["supply-chain-security","man-in-the-middle","uv"],"_cs_type":"advisory","_cs_vendors":["Astral Software"],"content_html":"\u003cp\u003eAstral Software uv versions prior to 0.13.4 are susceptible to man-in-the-middle (MITM) attacks due to the inclusion of the 'emSign ECC Root CA - G3' in the package manager's vendored trust store. Multiple intermediate CA certificates chaining to this specific root have had their private keys compromised, leading to the revocation of those intermediate certificates by the CA. Because uv relies on this vendored copy of the 'webpki-root-certs' bundle to verify TLS connections, it remains vulnerable to attackers who can issue fraudulent certificates using the compromised keys. This effectively allows an attacker to intercept, inspect, or modify network traffic intended for package repositories or other endpoints during uv execution. The vulnerability is resolved in uv version 0.13.4, which updates the vendored trust store to remove the affected root certificate.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows an attacker to conduct transparent man-in-the-middle attacks against users running outdated versions of uv. This could lead to the interception of credentials, the injection of malicious packages, or the modification of project dependencies during the installation or synchronization process. The scope of impact is broad, affecting any developer or automated build system using vulnerable versions of uv for Python package management.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritized actions for security and engineering teams to mitigate exposure to this vulnerability.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade the uv package manager to version 0.13.4 or later across all development environments, CI/CD pipelines, and build servers immediately to remove the compromised root certificate.\u003c/li\u003e\n\u003cli\u003eAudit build logs and network traffic for connections originating from automated systems using older versions of uv to identify potential signs of interception during the transition period.\u003c/li\u003e\n\u003cli\u003eImplement centralized management of trusted CA stores where possible to ensure consistency and minimize reliance on individual package managers' vendored trust bundles.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-20T23:53:13Z","date_published":"2026-10-20T23:53:13Z","id":"https://feed.craftedsignal.io/briefs/2026-10-uv-mitm-vulnerability/","summary":"The uv package manager, in versions prior to 0.13.4, included a vulnerable root certificate in its vendored trust store, allowing attackers to perform man-in-the-middle attacks using compromised intermediate CA keys.","title":"Astral Software uv: Man-in-the-middle vulnerability via compromised emSign CA","url":"https://feed.craftedsignal.io/briefs/2026-10-uv-mitm-vulnerability/"}],"language":"en","title":"CraftedSignal Threat Feed - Uv (\u003c 0.13.4)","version":"https://jsonfeed.org/version/1.1"}