AI Threat AlertCVE-2025-13327: uv: ZIP parsing differential allows code execution
MEDIUMA flaw in uv, the Python package installer widely used in ML build and container workflows, lets a specially crafted ZIP archive exploit a parsing differential so that malicious code runs during package resolution or installation. Exploitation needs local access, high privileges, high attack complexity and a user installing an attacker-controlled package, which is why the CVSS score is a moderate 6.3. There is no EPSS score, no known public exploit, no Nuclei template and no CISA KEV listing, so near-term mass exploitation is unlikely. The reach is wide, though: 94 downstream dependents are tracked, and Red Hat has shipped advisories (RHSA-2026:91219, 91232, 91236) covering RHEL AI and OpenShift AI base images, including vLLM, PyTorch, TensorFlow and Jupyter workbenches. Apply the vendor errata and upgrade uv to a release containing the upstream fix (GHSA-pqhf-p39g-3x64), rebuild affected images, and restrict installs to trusted, pinned and hash-verified package sources.
What is the risk?
Medium overall. Exploitation requires a user or CI job to install an attacker-controlled package (UI:R), high privileges and high complexity (AC:H, PR:H), so opportunistic attacks are unlikely. If it succeeds, confidentiality, integrity and availability impact is high, and in AI pipelines the host often holds GPU credentials, model weights, API keys and data-store access. There is no evidence of active exploitation, no public exploit and no KEV listing. Risk rises in automated build systems that resolve unpinned or third-party dependencies. The patched-version information was not available in the supplied data, so confirm the fixed release in the upstream advisory.
How does the attack unfold?
What systems are affected?
How severe is it?
What is the attack surface?
What should I do?
1 step1) Patch: apply the Red Hat errata RHSA-2026:91219, RHSA-2026:91232 and RHSA-2026:91236 to affected RHEL AI and OpenShift AI images, and upgrade standalone uv to a release containing the upstream fix (commit da659fee, GHSA-pqhf-p39g-3x64). Confirm the exact fixed version in the advisory because it was not supplied here. 2) Rebuild and redeploy container images and workbenches that bundle uv. 3) Workarounds: install only from trusted internal mirrors or registries, pin dependencies with hash verification, and avoid installing ad hoc archives or packages from untrusted sources. 4) Isolate: run installs in ephemeral, least-privilege build sandboxes with no production secrets. 5) Detect: monitor build and workbench logs for unexpected child processes or network connections during uv resolve and install, and audit recent installs of unvetted packages.
How is it classified?
Which compliance frameworks are affected?
This CVE is relevant to:
Frequently Asked Questions
What is CVE-2025-13327?
A flaw in uv, the Python package installer widely used in ML build and container workflows, lets a specially crafted ZIP archive exploit a parsing differential so that malicious code runs during package resolution or installation. Exploitation needs local access, high privileges, high attack complexity and a user installing an attacker-controlled package, which is why the CVSS score is a moderate 6.3. There is no EPSS score, no known public exploit, no Nuclei template and no CISA KEV listing, so near-term mass exploitation is unlikely. The reach is wide, though: 94 downstream dependents are tracked, and Red Hat has shipped advisories (RHSA-2026:91219, 91232, 91236) covering RHEL AI and OpenShift AI base images, including vLLM, PyTorch, TensorFlow and Jupyter workbenches. Apply the vendor errata and upgrade uv to a release containing the upstream fix (GHSA-pqhf-p39g-3x64), rebuild affected images, and restrict installs to trusted, pinned and hash-verified package sources.
Is CVE-2025-13327 actively exploited?
No confirmed active exploitation of CVE-2025-13327 has been reported, but organizations should still patch proactively.
How to fix CVE-2025-13327?
1) Patch: apply the Red Hat errata RHSA-2026:91219, RHSA-2026:91232 and RHSA-2026:91236 to affected RHEL AI and OpenShift AI images, and upgrade standalone uv to a release containing the upstream fix (commit da659fee, GHSA-pqhf-p39g-3x64). Confirm the exact fixed version in the advisory because it was not supplied here. 2) Rebuild and redeploy container images and workbenches that bundle uv. 3) Workarounds: install only from trusted internal mirrors or registries, pin dependencies with hash verification, and avoid installing ad hoc archives or packages from untrusted sources. 4) Isolate: run installs in ephemeral, least-privilege build sandboxes with no production secrets. 5) Detect: monitor build and workbench logs for unexpected child processes or network connections during uv resolve and install, and audit recent installs of unvetted packages.
What systems are affected by CVE-2025-13327?
This vulnerability affects the following AI/ML architecture patterns: training pipelines, model serving, ML development environments, CI/CD build pipelines, container images for AI workloads.
What is the CVSS score for CVE-2025-13327?
CVE-2025-13327 has a CVSS v3.1 base score of 6.3 (MEDIUM). The EPSS exploitation probability is 0.17%.
What is the AI security impact?
Affected AI Architectures
MITRE ATLAS Techniques
AML.T0010.001AI SoftwareAML.T0011User ExecutionAML.T0011.001Malicious PackageCompliance Controls Affected
What are the technical details?
Original Advisory
A flaw was found in uv. This vulnerability allows an attacker to execute malicious code during package resolution or installation via specially crafted ZIP (Zipped Information Package) archives that exploit parsing differentials, requiring user interaction to install an attacker-controlled package.
Exploitation Scenario
An attacker publishes a package or wheel that looks legitimate, or supplies a malicious archive through a shared artifact location, and the ZIP is built so that different parsers read it differently. A data scientist or CI job running uv in an ML workbench or image build installs it. The parser discrepancy lets uv process hidden content, so attacker code runs with the user's privileges during resolution or installation. The attacker then harvests API keys, cloud credentials and model-registry tokens from the environment, and can tamper with other installed packages so the compromise carries into training or inference images.
Weaknesses (CWE)
CWE-1286 — Improper Validation of Syntactic Correctness of Input: The product receives input that is expected to be well-formed - i.e., to comply with a certain syntax - but it does not validate or incorrectly validates that the input complies with the syntax.
- [Implementation] Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue." Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylis
Source: MITRE CWE corpus.
CVSS Vector
CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:HReferences
- access.redhat.com/errata/RHSA-2026:91219vendor-advisoryx_refsource_REDHAT
- access.redhat.com/errata/RHSA-2026:91232vendor-advisoryx_refsource_REDHAT
- access.redhat.com/errata/RHSA-2026:91236vendor-advisoryx_refsource_REDHAT
- access.redhat.com/security/cve/CVE-2025-13327vdb-entryx_refsource_REDHAT
- bugzilla.redhat.com/show_bug.cgiissue-trackingx_refsource_REDHAT
- github.com/astral-sh/uv
- github.com/astral-sh/uv/commit/da659fee4898a73dbc75070f3e82d49f745e4628
- github.com/astral-sh/uv/security/advisories/GHSA-pqhf-p39g-3x64
Timeline
Related Vulnerabilities
CVE-2026-6173210.0Decepticon: ChatML token injection yields sandbox RCE
Same package: vllmCVE-2024-110419.8vllm: RCE via unsafe pickle deserialization in MessageQueue
Same package: vllmCVE-2026-259609.8vllm: SSRF allows internal network access
Same package: vllmCVE-2025-472779.8vLLM: RCE via exposed TCPStore in distributed inference
Same package: vllmCVE-2024-90539.8vllm: RCE via unsafe pickle deserialization in RPC server
Same package: vllm