uv lookup reads process HOME outside supplied environment #200

When an explicit env mapping omits HOME, uv interpreter discovery still searches the process HOME. This can execute a candidate outside the locations named by the mapping. Release 1.9.1 and main 1d88a437de96fb335e2e4044e71341b9c101980c reproduce.

The full reproduction is in draft advisory GHSA-828q-59cf-rgp5, visible to repository maintainers.

Affected code

_uv_state_dirs() substitutes ~ for a missing mapped home and expands it against the process environment.

Impact

If another local user can write the process HOME uv store, a privileged caller can run that user's candidate during discovery. Reproducibility is moderate because the lookup must reach the store; exposure is niche because the process HOME must be writable by another user while the caller omits HOME from the explicit mapping.

Credits

Reported by Anthropic's OSS Scanner: ANT-2026-XQVCZ8E5.