Vendor
The uv package manager, in versions prior to 0.13.4, included a vulnerable root certificate in its vendored trust store, allowing attackers to perform man-in-the-middle attacks using compromised intermediate CA keys.