Code execution via inconsistent ZIP parsing

ZIP parsing differentials in Astral uv 0.9.5 and earlier allow attackers to execute code by installing an attacker-controlled package. uv-extract misreads central-directory comment bytes as ZIP control structures and skips filenames containing null bytes, producing archives that other Python installers extract differently. The user must install an attacker-controlled package; source ZIPs can execute during a build, malicious wheels require a later import, and affected Red Hat AI products embed uv in container images.