Skip to content
Threat Feed
Subscribe

Tag

Uv

1 brief RSS
critical advisory

Astral Software uv: Man-in-the-middle vulnerability via compromised emSign CA

The uv package manager, in versions prior to 0.13.4, included a vulnerable root certificate in its vendored trust store, allowing attackers to perform man-in-the-middle attacks using compromised intermediate CA keys.

uv supply-chain-security man-in-the-middle
1t