CVE-2025-47273
MediumSummary
Setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. A path traversal vulnerability in PackageIndex is present in setuptools prior to version 78.1.1. An attacker can write files to arbitrary locations on the filesystem.
Risk Assessment
An attacker could overwrite critical system or configuration files, potentially leading to remote code execution or privilege escalation.
Recommendation
Upgrade setuptools to version 78.1.1 or later.
Other vulnerabilities in setuptools
See all- GHSA-xmj3-9gf7-h52wLow
On Windows, attacker-controlled content in a wheel's .dist-info/namespace_packages.txt can cause setuptools' legacy wheel installation path to create an __init__.py outside the requested destination_eggdir. The attacker can influence the destination path but not the file contents.
- CVE-2026-59890Medium
In setuptools prior to version 83.0.0, MANIFEST.in directives (exclude, global-exclude, recursive-exclude, prune) were applied without Unicode normalization, allowing on macOS APFS or HFS+ an NFD file name to bypass an NFC exclusion rule and be included in a source distribution.
Original NVD description (English source)
setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. A path traversal vulnerability in `PackageIndex` is present in setuptools prior to version 78.1.1. An attacker would be allowed to write files to arbitrary locations on the filesystem with
Vulnerability data from NVD (NIST) · CISA KEV · EPSS