GHSA-hq85-5cpj-mr62: uv's bundled CA store trusts an emSign root whose intermediate CA keys are compromised

By default uv does not use the operating system's trust store. It checks servers against its own copy of the webpki-root-certs bundle, so a distro-level fix does not protect it. Because that copy still contained the emSign ECC G3 root, a certificate signed by any of the eight compromised intermediates validates for any hostname, for example a package index or a Git host.

The attacker needs one of the leaked keys and a position on the network path between the developer or CI runner and the server. That is a high bar, which the CVSS 4.0 vector reflects with high attack complexity. With it, they can read and alter traffic: swap a wheel or sdist for a malicious one, steal index credentials or tokens, or tamper with resolved dependencies. The result is code execution on whatever installs the package. CI runners that install dependencies on shared or untrusted networks are the likeliest targets.

Affected: uv versions below 0.13.4 that use the default bundled certificate store. Check the version:

uv --version
pip show uv

Check pinned installs in CI images, Dockerfiles (for example COPY --from=ghcr.io/astral-sh/uv), and tool caches, since each carries its own binary.

Upgrade to uv 0.13.4 or later. It removes the root from the vendored bundle, following webpki-root-certs 1.0.10.

uv self update

If you installed through pip, run pip install --upgrade uv. Rebuild container images and refresh CI caches that pin an older binary. The advisory lists no workaround. Updating the system CA store does not help while uv uses its bundled one.

Inventory uv versions across developer machines, CI images and containers. In TLS logs or captures, look for certificates presented to uv that were issued by an eMudhra or emSign intermediate for hosts that normally use another CA. For environments that downloaded packages on untrusted networks, verify installed artifacts against lockfile hashes.

By default, uv verifies TLS connections against a vendored copy of the webpki-root-certs bundle. Versions before 0.13.4 include the emSign ECC Root CA - G3 root. Eight eMudhra intermediate CA certificates that chain to that root have compromised private keys, and the CA has revoked them.

An attacker with one of the compromised keys can issue certificates that uv accepts for any hostname, and can be used to issue certificates to enable MITM attacks.

uv 0.13.4 removes the root from its vendored bundle, following webpki-root-certs 1.0.10. Upgrade to 0.13.4 or later.