Skip to main content

Improper Validation of Syntactic Correctness of Input

CVE-2025-13327

Medium
6.3/10

Summary

A flaw was found in uv. This vulnerability allows an attacker to execute malicious code during package resolution or installation via specially crafted ZIP (Zipped Information Package) archives that exploit parsing differentials, requiring user interaction to install an attacker-controlled package.

  • HIGH
  • LOCAL
  • HIGH
  • UNCHANGED
  • REQUIRED
  • HIGH
  • HIGH
  • HIGH

CWE-1286 - Improper Validation of Syntactic Correctness of Input

The product receives input that is expected to be well-formed - i.e., to comply with a certain syntax - but it does not validate or incorrectly validates that the input complies with the syntax.

References

Advisory Timeline

  • Published