---
title: "uv security advisory: ZIP payload obfuscation"
url: https://daily.dev/posts/uv-security-advisory-zip-payload-obfuscation-eb01xp9ti
source_url: https://astral.sh/blog/uv-security-advisory-cve-2025-54368
type: article
source: "Astral"
published: 2026-03-31T12:27:03.658Z
updated: 2026-03-31T12:31:46.125Z
tags: ["security"]
reading_time: 12
upvotes: 0
comments: 0
language: en
---

> ## Documentation Index
> Fetch the complete documentation index at: https://daily.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# uv security advisory: ZIP payload obfuscation

**[Astral](https://daily.dev/sources/astral-sh)** · 12 min read · 0 upvotes · 0 comments

## Summary

A security advisory (CVE-2025-54368) has been issued for uv, the Python package installer, covering two ZIP parsing differentials that could allow an attacker to craft a ZIP file that extracts differently across uv and pip, or appears harmless to security scanners while containing a malicious payload. The two vulnerabilities involve 'dangling files' (local file entries without central directory headers) and 'doubled ZIPs' (ambiguity in whether the central directory offset is absolute or relative). Coordination with the Python Security Response Team and PyPI confirmed no exploitation occurred on PyPI, and PyPI has added upload checks to prevent future abuse. The fix is in uv v0.8.6, which now reconciles local file entries with the central directory and rejects malformed ZIPs. The advisory notes that ZIP format ambiguities make parser differentials a broader ecosystem risk beyond uv alone.

## Full article

daily.dev links to this article rather than hosting it. Read it at the original source: <https://astral.sh/blog/uv-security-advisory-cve-2025-54368>

## Similar posts on daily.dev

- [Vulnerability and malware checks in uv](https://daily.dev/posts/vulnerability-and-malware-checks-in-uv-wuu9roi2k) · Astral · 47 upvotes · 5 comments
- [Python Software Foundation News: Improving security and integrity of Python package archives](https://daily.dev/posts/python-software-foundation-news-improving-security-and-integrity-of-python-package-archives-o52unhqvo) · Python Software Foundation · 2 upvotes · 0 comments
- [How to get pwned with — extra-index-url](https://daily.dev/posts/how-to-get-pwned-with-extra-index-url-zwbaxgvgq) · InfoSec Write-ups · 0 upvotes · 0 comments

---

Tags: [#security](https://daily.dev/tags/security)

[View this post on daily.dev](https://daily.dev/posts/uv-security-advisory-zip-payload-obfuscation-eb01xp9ti)