setuptools

PyPI · Package

6 reports

Vulnerability alerts

Report	Product	Ecosystem	Severity	Fix status	Last updated
setuptools: Windows path escape via namespace_packages.txt during legacy wheel installation DescriptionGHSA-XMJ3-9GF7-H52W	setuptools	PyPI	Low	Fix reported	2026-10-24
setuptools: MANIFEST.in exclusion bypass in sdist via Unicode normalization collision (NFC/NFD) on macOS APFS/HFS+CVE-2026-59890 · GHSA-H35F-9H28-MQ5CVersion ranges need review.	setuptools	PyPI	Medium	Fix reported	2026-07-21
setuptools vulnerable to Command Injection via package URLCVE-2024-6345 · GHSA-CX63-2MW6-8HW5Version ranges need review.	setuptools Multiarch Tuning Operator/multiarch-tuning/multiarch-tuning-rhel9-operator	PyPIRed Hat	High	Fix reported	2026-07-07
pypa/setuptools vulnerable to Regular Expression Denial of Service (ReDoS)CVE-2022-40897 · GHSA-R9HX-VWMV-Q579Version ranges need review.	setuptools Red Hat Enterprise Linux 6/python-setuptools	PyPIRed Hat	High	Fix reported	2026-06-10
Setuptools vulnerable to Man-in-the-middle attacksCVE-2013-1633 · GHSA-27X4-J476-JP5FVersion ranges need review.	setuptools OpenShift Enterprise 1/python-virtualenv	PyPIRed Hat	High	Fix reported	2026-06-10
setuptools has a path traversal vulnerability in PackageIndex.download that leads to Arbitrary File WriteCVE-2025-47273 · GHSA-5RJG-FVGR-3XXFVersion ranges need review.	setuptools Confidential Compute Attestation/confidential-compute-attestation-tech-preview/trustee-rhel9	PyPIRed Hat	High	Fix reported	2026-05-11