GHSA-xmj3-9gf7-h52w
LowSummary
On Windows, attacker-controlled content in a wheel's .dist-info/namespace_packages.txt can cause setuptools' legacy wheel installation path to create an __init__.py outside the requested destination_eggdir. The attacker can influence the destination path but not the file contents.
Risk Assessment
An attacker could cause a file to be written outside the intended installation directory, potentially overwriting or creating files in unexpected locations. This may compromise filesystem integrity during package installation.
Recommendation
Update setuptools to a version containing the fix or avoid the legacy wheel installation path. Verify packages installed from untrusted sources.
Other vulnerabilities in setuptools
See all- CVE-2025-47273Medium
Setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. A path traversal vulnerability in PackageIndex is present in setuptools prior to version 78.1.1. An attacker can write files to arbitrary locations on the filesystem.
- CVE-2026-59890Medium
In setuptools prior to version 83.0.0, MANIFEST.in directives (exclude, global-exclude, recursive-exclude, prune) were applied without Unicode normalization, allowing on macOS APFS or HFS+ an NFD file name to bypass an NFC exclusion rule and be included in a source distribution.
Original NVD description (English source)
### Summary On Windows, attacker-controlled content in a wheel's `.dist-info/namespace_packages.txt` can cause setuptools' legacy wheel installation path to create an `__init__.py` outside the requested `destination_eggdir`. The attacker can influence the destination path, but not the contents of
Vulnerability data from NVD (NIST) · CISA KEV · EPSS