Astral Software - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/vendors/astral-software/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 20 Oct 2026 23:53:13 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgAstral Software uv: Man-in-the-middle vulnerability via compromised emSign CAhttps://feed.craftedsignal.io/briefs/2026-10-uv-mitm-vulnerability/Tue, 20 Oct 2026 23:53:13 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-uv-mitm-vulnerability/The uv package manager, in versions prior to 0.13.4, included a vulnerable root certificate in its vendored trust store, allowing attackers to perform man-in-the-middle attacks using compromised intermediate CA keys.Astral Software uv versions prior to 0.13.4 are susceptible to man-in-the-middle (MITM) attacks due to the inclusion of the 'emSign ECC Root CA - G3' in the package manager's vendored trust store. Multiple intermediate CA certificates chaining to this specific root have had their private keys compromised, leading to the revocation of those intermediate certificates by the CA. Because uv relies on this vendored copy of the 'webpki-root-certs' bundle to verify TLS connections, it remains vulnerable to attackers who can issue fraudulent certificates using the compromised keys. This effectively allows an attacker to intercept, inspect, or modify network traffic intended for package repositories or other endpoints during uv execution. The vulnerability is resolved in uv version 0.13.4, which updates the vendored trust store to remove the affected root certificate.

Impact

Successful exploitation allows an attacker to conduct transparent man-in-the-middle attacks against users running outdated versions of uv. This could lead to the interception of credentials, the injection of malicious packages, or the modification of project dependencies during the installation or synchronization process. The scope of impact is broad, affecting any developer or automated build system using vulnerable versions of uv for Python package management.

Recommendation

Prioritized actions for security and engineering teams to mitigate exposure to this vulnerability.

  • Upgrade the uv package manager to version 0.13.4 or later across all development environments, CI/CD pipelines, and build servers immediately to remove the compromised root certificate.
  • Audit build logs and network traffic for connections originating from automated systems using older versions of uv to identify potential signs of interception during the transition period.
  • Implement centralized management of trusted CA stores where possible to ensure consistency and minimize reliance on individual package managers' vendored trust bundles.
]]>criticaladvisorysupply-chain-securityman-in-the-middleuv