CVE-2026-59890

Published: Jul 8, 2026Modified: Jul 13, 2026

6.1

Vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N

Exploitability: 1.8 / Impact: 4.2

Source: security-advisories@github.com (Secondary)

Description

setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. Prior to 83.0.0, FileList applied MANIFEST.in exclude, global-exclude, recursive-exclude, and prune directives by matching compiled glob patterns against on-disk file names without Unicode normalization, so on macOS APFS or HFS+ an NFD file name could bypass an NFC exclusion rule and be packed into a source distribution. This issue is fixed in version 83.0.0.

Affected (1)

Products: Python: Setuptools

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Python Setuptools	Before 83.0.0

Related CWEs

Improper Handling of Unicode Encoding

The product does not properly handle when an input contains Unicode encoding.

Incorrect Comparison

The product compares two entities in a security-relevant context, but the comparison is incorrect, which may lead to resultant weaknesses.

References (4)

https://github.com/pypa/setuptools/commit/dd9f436a36486b4cb8a4c70a2321548b0be09b8f

Source: security-advisories@github.com

Patch

https://github.com/pypa/setuptools/releases/tag/v83.0.0

Source: security-advisories@github.com

Release Notes

https://github.com/pypa/setuptools/security/advisories/GHSA-h35f-9h28-mq5c

Source: security-advisories@github.com

ExploitVendor AdvisoryMitigation

https://github.com/pypa/setuptools/security/advisories/GHSA-h35f-9h28-mq5c

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

ExploitVendor AdvisoryMitigation

Timeline

No history available yet.