CVE-2026-59890
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk35th percentile - higher than 35% of all known CVEs
Summary
In setuptools prior to version 83.0.0, MANIFEST.in directives (exclude, global-exclude, recursive-exclude, prune) were applied without Unicode normalization, allowing on macOS APFS or HFS+ an NFD file name to bypass an NFC exclusion rule and be included in a source distribution.
Risk Assessment
The organization may unintentionally distribute files that should be excluded (e.g., configuration files, sensitive data), increasing the risk of information leakage or security policy violation.
Recommendation
Immediately upgrade setuptools to version 83.0.0 or later, which includes the Unicode normalization fix for glob patterns.
Other vulnerabilities in setuptools
See all- CVE-2025-47273Medium
Setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. A path traversal vulnerability in PackageIndex is present in setuptools prior to version 78.1.1. An attacker can write files to arbitrary locations on the filesystem.
- GHSA-xmj3-9gf7-h52wLow
On Windows, attacker-controlled content in a wheel's .dist-info/namespace_packages.txt can cause setuptools' legacy wheel installation path to create an __init__.py outside the requested destination_eggdir. The attacker can influence the destination path but not the file contents.
Original NVD description (English source)
setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. Prior to 83.0.0, FileList applied MANIFEST.in exclude, global-exclude, recursive-exclude, and prune directives by matching compiled glob patterns against on-disk file names without Unicode normalization, so on macOS APFS or HFS+ an NFD file name could bypass an NFC exclusion rule and be packed into a source distribution. This issue is fixed in version 83.0.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS