No published models are known to use this package.
cvss
9.0
critical
severity band, no base score published
epss
not scored
chance of exploitation in 30 days
xyz score
5.2
medium
CyberXYZ composite out of 10
fig. 01 — GHSA-hq85-5cpj-mr62, the advisory selected below
// 7 advisories
GHSA-hq85-5cpj-mr62
CRITICALGitHub rating
By default, uv verifies TLS connections against a vendored copy of the webpki-root-certs bundle. Versions before 0.13.4 include the emSign ECC Root CA - G3 root. Eight eMudhra intermediate CA certificates that chain to that root have compromised private keys, and the CA has revoked them.
An attacker with one of the compromised keys can issue certificates that uv accepts for any hostname, and can be used to issue certificates to enable MITM attacks.
uv 0.13.4 removes the root from its vendored bundle, following webpki-root-certs 1.0.10. Upgrade to 0.13.4 or later.
Checked 2026-11-06 at 21:24 UTC. The most recent advisory here was published 2026-10-20. Updated continuously from NVD, GHSA, OSV and CNA feeds.