Record · corpus.blog/posts/01a0b5c5-1f1b-7166-87d6-7a9b5b82c1ef

uv security advisory: ZIP payload obfuscation

astral.sh · published 7 August 2025

A record is what was published and who pointed at it. The text of the post is not held here: read it at the source, or at its Wayback capture.

Read the post at astral.sh Wayback capture

1blogs citing

First cited: 7 Aug 2025
Most recent: 7 Aug 2025
Rank this month: not ranked
External links: 18
Words captured: 2,238

Cited by

Blog

In the post

Date

PyPI Blog

Preventing ZIP parser confusion attacks on Python package installers Read at the source ↗

7 Aug 2025

Links from this post

Link

Host

https://github.com/astral-sh/uv

github.com

https://github.com/astral-sh/uv/security/advisories/GHSA-8qf3-x8v5-2pj8

github.com

https://github.com/astral-sh/uv/releases/tag/0.8.6

github.com

What is a parser mismatch vulnerability? Read at the source ↗

brainonfire.net

https://pip.pypa.io/en/stable/

pip.pypa.io

https://devguide.python.org/developer-workflow/psrt/

devguide.python.org

https://en.wikipedia.org/wiki/ZIP_(file_format

en.wikipedia.org

https://github.com/astral-sh/rs-async-zip

github.com

https://docs.python.org/3/library/zipfile.html

docs.python.org

https://langsec.org/occupy/

langsec.org

https://github.com/calebbrown

github.com

https://github.com/thatch

github.com

https://sethmlarson.dev

sethmlarson.dev

https://github.com/miketheman

github.com

Preventing ZIP parser confusion attacks on Python package installers Read at the source ↗

blog.pypi.org

Postel's Law and the Three Ring Circus Read at the source ↗

alexgaynor.net

https://pkware.cachefly.net/webdocs/casestudies/APPNOTE.TXT

pkware.cachefly.net

https://en.wikipedia.org/wiki/Floppy_disk

en.wikipedia.org