setuptools vulnerabilities

Setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. A path traversal vulnerability in PackageIndex is present in setuptools prior to version 78.1.1. An attacker can write files to arbitrary locations on the filesystem.

On Windows, attacker-controlled content in a wheel's .dist-info/namespace_packages.txt can cause setuptools' legacy wheel installation path to create an __init__.py outside the requested destination_eggdir. The attacker can influence the destination path but not the file contents.

In setuptools prior to version 83.0.0, MANIFEST.in directives (exclude, global-exclude, recursive-exclude, prune) were applied without Unicode normalization, allowing on macOS APFS or HFS+ an NFD file name to bypass an NFC exclusion rule and be included in a source distribution.