Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 5

Export CSV
CVE-2026-59890

setuptools: MANIFEST.in exclusion bypass in sdist via Unicode normalization collision (NFC/NFD) on macOS APFS/HFS+

setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. Prior to 83.0.0, FileList applied MANIFEST.in exclude, global-exclude, recursive-exclude, and prune directives by matching compiled glob patterns against on-disk file names without Unicode normalization, so on macOS APFS or HFS+ an NFD file name could bypass an NFC exclusion rule and be packed into a source distribution. This issue is fixed in version 83.0.0.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Python
Products
Setuptools
CVE-2024-6345

Remote Code Execution in pypa/setuptools

A vulnerability in the package_index module of pypa/setuptools versions up to 69.1.1 allows for remote code execution via its download functions. These functions, which are used to download packages from URLs provided by users or retrieved from package index servers, are susceptible to code injection. If these functions are exposed to user-controlled inputs, such as package URLs, they can execute arbitrary commands on the system. The issue is fixed in version 70.0.

CVSS 3.1 · 8.8 High EPSS 1.9% KEV · Not listed
Vendors
Python Redhat
Products
Setuptools Enterprise Linux Openshift and 7 more
CVE-2022-40897

pypa-setuptools: Regular Expression Denial of Service (ReDoS) in package_index.py

Python Packaging Authority (PyPA) setuptools before 65.5.1 allows remote attackers to cause a denial of service via HTML in a crafted package or custom PackageIndex page. There is a Regular Expression Denial of Service (ReDoS) in package_index.py.

CVSS 3.1 · 5.9 Medium EPSS 2.6% KEV · Not listed
Vendors
Python Redhat
Products
Setuptools Enterprise Linux Rhel Aus and 4 more
CVE-2025-47273

setuptools has a path traversal vulnerability in PackageIndex.download that leads to Arbitrary File Write

setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. A path traversal vulnerability in `PackageIndex` is present in setuptools prior to version 78.1.1. An attacker would be allowed to write files to arbitrary locations on the filesystem with the permissions of the process running the Python code, which could escalate to remote code execution depending on the context. Version 78.1.1 fixes the issue.

CVSS 4.0 · 7.7 High EPSS 1.6% KEV · Not listed
Vendors
Debian Python Redhat
Products
Debian Linux Setuptools Enterprise Linux and 1 more
CVE-2013-1633

python-setuptools: easy_install insecure installation mechanism

easy_install in setuptools before 0.7 uses HTTP to retrieve packages from the PyPI repository, and does not perform integrity checks on package contents, which allows man-in-the-middle attackers to execute arbitrary code via a crafted response to the default use of the product.

CVSS 2.0 · 6.8 Medium EPSS 2.0% KEV · Not listed
Vendors
Python
Products
Setuptools