CVE-2026-59890

MediumCVSS 6.1

Published: 08/07/2026(UTC)Updated: 13/07/2026(UTC)Translated: 14/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.27%

19th percentile - higher than 19% of all known CVEs

Summary

In setuptools prior to version 83.0.0, MANIFEST.in directives (exclude, global-exclude, recursive-exclude, prune) were applied without Unicode normalization, allowing on macOS APFS or HFS+ an NFD file name to bypass an NFC exclusion rule and be included in a source distribution.

Risk Assessment

The organization may unintentionally distribute files that should be excluded (e.g., configuration files, sensitive data), increasing the risk of information leakage or security policy violation.

Recommendation

Immediately upgrade setuptools to version 83.0.0 or later, which includes the Unicode normalization fix for glob patterns.

Other vulnerabilities in setuptools

CVE-2025-47273Medium
Setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. A path traversal vulnerability in PackageIndex is present in setuptools prior to version 78.1.1. An attacker can write files to arbitrary locations on the filesystem.

Original NVD description (English source)

setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. Prior to 83.0.0, FileList applied MANIFEST.in exclude, global-exclude, recursive-exclude, and prune directives by matching compiled glob patterns against on-disk file names without Unicode normalization, so on macOS APFS or HFS+ an NFD file name could bypass an NFC exclusion rule and be packed into a source distribution. This issue is fixed in version 83.0.0.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS