[zahlman]

Since this came up specifically for `uv` (i.e. since the Python ecosystem relies on source distributions packaged as .tar.gz): has the Python standard library implementation (which is used by pip) been checked for a similar vulnerability?

[denhamparry]

It is unlikely to have the bug as it sees more use, but it is worth checking. There have been previous CVEs with Pythons tar module.