GHSA-hq85-5cpj-mr62
CriticalAdvisory
Published 20 Oct 2026In the index since 21 Oct 2026
- Severity
- Critical
- worst across findings
- CVSS
- 9.1
- base score, highest
- EPSS
- —
- probability of exploitation
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 60
- of 18,208 indexed, latest versions
- Container images
- 58
- deployed by those charts
- Fix available
- 1 of 1
- affected package
uv's bundled CA store trusts an emSign root whose intermediate CA keys are compromised
Carried by container images the latest versions of 60 of 18,208 indexed charts deploy, on 58 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| uvpypi | 0.4.1, 0.4.29, 0.5.6, 0.5.27+35 more | 0.13.4 | 58 |
- OSV records
- GHSA-hq85-5cpj-mr62
- Also known as
- PYSEC-2026-4321
Charts affected
60 by stars
| Chart | Latest | Affected images | Radar Score |
|---|---|---|---|
| home-assistantnewbenji-chartsVerified publisher | 0.7.2 | 1 of 1See more | 3,747 |
| music-assistantnewbenji-chartsVerified publisher | 0.1.0 | 1 of 1See more | 5,023 |
| osdfir-infrastructureosdfir-infrastructureVerified publisher | 2.15.0 | 1 of 40See more | 242,131 |
| yetiosdfir-infrastructureVerified publisher | 1.0.5 | 1 of 4See more | 7,163 |
| home-assistantpascaliskeVerified publisher | 0.1.1 | 1 of 1See more | 6,564 |
| prowlerprowler | 0.1.1 | 1 of 1See more | 2,342 |
| rada-platformrada-platform | 0.1.0 | 1 of 7See more | 24,386 |
| home-assistantsmall-hack | 2.1.0 | 1 of 1See more | 5,631 |
| planoupstreamyardVerified publisher | 0.1.0 | 1 of 1See more | 775 |
| zoo-project-druzoo-projectOfficialVerified publisher | 0.10.9 | 1 of 6See more | 7,561 |
Container images carrying it
58 by charts deploying them
A fixed version is listed for 1 of the 1 affected package.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| ghcr.io/ | 3522e8a7a8f0 | uv | 0.13.4 | 1 |
| ghcr.io/ | 45fdb050e069 | uv | 0.13.4 | 1 |
| ghcr.io/ | eef3ee7810d0 | uv | 0.13.4 | 1 |
| ghcr.io/ | 672faad776b5 | uv | 0.13.4 | 1 |
| public.ecr.aws/ | 048f3090de46 | uv | 0.13.4 | 1 |
| public.ecr.aws/ | 6abe7250a64e | uv | 0.13.4 | 1 |
| quay.io/ | 2c324c9789f5 | uv | 0.13.4 | 1 |
| registry.gitlab.com/ | dffe548b3c53 | uv | 0.13.4 | 1 |