{"id":"CVE-2026-59890","aliases":["AZL-110366","AZL-92229","BELL-CVE-2026-59890","BIT-setuptools-2026-59890","CLSA-2026-1786468462","CLSA-2026-1787028610","CLSA-2026-1787559705","CLSA-2026-1790749457","CLSA-2026-1791273613","CLSA-2026-1791274242","CLSA-2026-1791275059","CLSA-2026-1791366380","CLSA-2026-1791366704","EUVD-2026-42323","GHSA-h35f-9h28-mq5c","OESA-2026-3191","PYSEC-2026-3447","RHSA-2026:37530","UBUNTU-CVE-2026-59890"],"status":"published","title":"setuptools: MANIFEST.in exclusion bypass in sdist via Unicode normalization collision (NFC/NFD) on macOS APFS/HFS+","description":"setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. Prior to 83.0.0, FileList applied MANIFEST.in exclude, global-exclude, recursive-exclude, and prune directives by matching compiled glob patterns against on-disk file names without Unicode normalization, so on macOS APFS or HFS+ an NFD file name could bypass an NFC exclusion rule and be packed into a source distribution. This issue is fixed in version 83.0.0.","severity":{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.0053,"percentile":0.45169,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-176","CWE-697"],"published":"2026-07-08T16:02:07Z","modified":"2026-11-05T05:40:51Z","fixes":[{"ecosystem":"PyPI","package":"setuptools","fixed_in":["83.0.0"],"sources":["ghsa","osv"]},{"ecosystem":"Azure Linux:3","package":"python-setuptools","fixed_in":["69.0.3-6"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"py3-setuptools","fixed_in":["83.0.0-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:stream","package":"py3-setuptools","fixed_in":["83.0.0-r0"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"setuptools","fixed_in":["83.0.0"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"python3-setuptools","fixed_in":["53.0.0-12.el9.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"python3-setuptools-wheel","fixed_in":["53.0.0-12.el9.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:PyPI","package":"setuptools","fixed_in":["75.8.0.post2+tuxcare","75.3.2.post1+tuxcare","75.0.0.post2+tuxcare","70.3.0.post2+tuxcare","68.0.0.post2+tuxcare"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP4","package":"python-setuptools","fixed_in":["68.0.0-3.oe2403sp4"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"python-setuptools","fixed_in":["44.1.1-5.oe2003sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"python-setuptools","fixed_in":["59.4.0-7.oe2203sp4"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"python-setuptools","fixed_in":["68.0.0-3.oe2403sp1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP3","package":"python-setuptools","fixed_in":["68.0.0-3.oe2403sp3"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"python-setuptools","fixed_in":["0:83.0.0-4.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"python-setuptools-wheel","fixed_in":["0:83.0.0-4.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"python3-setuptools","fixed_in":["0:83.0.0-4.hum1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"setuptools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"83.0.0"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"setuptool","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.19.11-23"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"python-setuptools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"69.0.3-6"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"py3-setuptools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"65.6.0-r1"},{"fixed":"83.0.0-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:stream","package":"py3-setuptools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"65.6.0-r1"},{"fixed":"83.0.0-r0"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"setuptools","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"83.0.0"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"python3-setuptools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"53.0.0-12.el9.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"python3-setuptools-wheel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"53.0.0-12.el9.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"setuptools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"75.8.0"},{"fixed":"75.8.0.post2+tuxcare"}]}],"versions":["75.8.0","75.8.0.post1+tuxcare"]},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"setuptools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"75.3.2"},{"fixed":"75.3.2.post1+tuxcare"}]}],"versions":["75.3.2"]},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"setuptools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"75.0.0"},{"fixed":"75.0.0.post2+tuxcare"}]}],"versions":["75.0.0","75.0.0.post1+tuxcare"]},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"setuptools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"65.5.1"},{"fixed":"65.5.1.post2+tuxcare"}]}],"versions":["65.5.1","65.5.1.post1+tuxcare"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"setuptools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"60.0.0"},{"fixed":"60.0.0.post3+tuxcare"}]}],"versions":["60.0.0","60.0.0.post1+tuxcare","60.0.0.post2+tuxcare"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"setuptools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"59.8.0"},{"fixed":"59.8.0.post2+tuxcare"}]}],"versions":["59.8.0","59.8.0.post1+tuxcare"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"setuptools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"70.3.0"},{"fixed":"70.3.0.post2+tuxcare"}]}],"versions":["70.3.0","70.3.0.post1+tuxcare"]},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"setuptools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"68.0.0"},{"fixed":"68.0.0.post2+tuxcare"}]}],"versions":["68.0.0","68.0.0.post1+tuxcare"]},{"source":"osv","ecosystem":"PyPI","package":"setuptools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"83.0.0"}]}],"versions":["0.6b1","0.6b2","0.6b3","0.6b4","0.6c1","0.6c10","0.6c11","0.6c2","0.6c3","0.6c4","0.6c5","0.6c6","0.6c7","0.6c8","0.6c9","0.7.2","0.7.3","0.7.4","0.7.5","0.7.6","0.7.7","0.7.8","0.8","0.9","0.9.1","0.9.2","0.9.3","0.9.4","0.9.5","0.9.6","0.9.7","0.9.8","1.0","1.1","1.1.1","1.1.2","1.1.3","1.1.4","1.1.5","1.1.6","1.1.7","1.2","1.3","1.3.1","1.3.2","1.4","1.4.1","1.4.2","10.0","10.0.1","10.1","10.2","10.2.1","11.0","11.1","11.2","11.3","11.3.1","12.0","12.0.1","12.0.2","12.0.3","12.0.4","12.0.5","12.1","12.2","12.3","12.4","13.0","13.0.1","13.0.2","14.0","14.1","14.1.1","14.2","14.3","14.3.1","15.0","15.1","15.2","16.0","17.0","17.1","17.1.1","18.0","18.0.1","18.1","18.2","18.3","18.3.1","18.3.2","18.4","18.5","18.6","18.6.1","18.7","18.7.1","18.8","18.8.1","19.0","19.1","19.1.1","19.2","19.3","19.4","19.4.1","19.5","19.6","19.6.1","19.6.2","19.7","2.0","2.0.1","2.0.2","2.1","2.1.1","2.1.2","2.2","20.0","20.1","20.1.1","20.10.1","20.2.2","20.3","20.3.1","20.4","20.6.6","20.6.7","20.6.8","20.7.0","20.8.0","20.8.1","20.9.0","21.0.0","21.1.0","21.2.0","21.2.1","21.2.2","22.0.0","22.0.1","22.0.2","22.0.4","22.0.5","23.0.0","23.1.0","23.2.0","23.2.1","24.0.0","24.0.1","24.0.2","24.0.3","24.1.0","24.1.1","24.2.0","24.2.1","24.3.0","24.3.1","25.0.0","25.0.1","25.0.2","25.1.0","25.1.1","25.1.2","25.1.3","25.1.4","25.1.5","25.1.6","25.2.0","25.3.0","25.4.0","26.0.0","26.1.0","26.1.1","27.0.0","27.1.0","27.1.2","27.2.0","27.3.0","27.3.1","28.0.0","28.1.0","28.2.0","28.3.0","28.4.0","28.5.0","28.6.0","28.6.1","28.7.0","28.7.1","28.8.0","28.8.1","29.0.0","29.0.1","3.0","3.0.1","3.0.2","3.1","3.2","3.3","3.4","3.4.1","3.4.2","3.4.3","3.4.4","3.5","3.5.1","3.5.2","3.6","3.7","3.7.1","3.8","3.8.1","30.0.0","30.1.0","30.2.0","30.2.1","30.3.0","30.4.0","31.0.0","31.0.1","32.0.0","32.1.0","32.1.1","32.1.2","32.1.3","32.2.0","32.3.0","32.3.1","33.1.0","33.1.1","34.0.0","34.0.1","34.0.2","34.0.3","34.1.0","34.1.1","34.2.0","34.3.0","34.3.1","34.3.2","34.3.3","34.4.0","34.4.1","35.0.0","35.0.1","35.0.2","36.0.1","36.1.0","36.1.1","36.2.0","36.2.1","36.2.2","36.2.3","36.2.4","36.2.5","36.2.6","36.2.7","36.3.0","36.4.0","36.5.0","36.6.0","36.6.1","36.7.0","36.7.1","36.7.2","36.8.0","37.0.0","38.0.0","38.1.0","38.2.0","38.2.1","38.2.3","38.2.4","38.2.5","38.3.0","38.4.0","38.4.1","38.5.0","38.5.1","38.5.2","38.6.0","38.6.1","38.7.0","39.0.0","39.0.1","39.1.0","39.2.0","4.0","4.0.1","40.0.0","40.1.0","40.1.1","40.2.0","40.3.0","40.4.0","40.4.1","40.4.2","40.4.3","40.5.0","40.6.0","40.6.1","40.6.2","40.6.3","40.7.0","40.7.1","40.7.2","40.7.3","40.8.0","40.9.0","41.0.0","41.0.1","41.1.0","41.2.0","41.3.0","41.4.0","41.5.0","41.5.1","41.6.0","42.0.0","42.0.1","42.0.2","43.0.0","44.0.0","44.1.0","44.1.1","45.0.0","45.1.0","45.2.0","45.3.0","46.0.0","46.1.0","46.1.1","46.1.2","46.1.3","46.2.0","46.3.0","46.3.1","46.4.0","47.0.0","47.1.0","47.1.1","47.2.0","47.3.0","47.3.1","47.3.2","48.0.0","49.0.0","49.0.1","49.1.0","49.1.1","49.1.2","49.1.3","49.2.0","49.2.1","49.3.0","49.3.1","49.3.2","49.4.0","49.5.0","49.6.0","5.0","5.0.1","5.0.2","5.1","5.2","5.3","5.4","5.4.1","5.4.2","5.5","5.5.1","5.6","5.7","5.8","50.0.0","50.0.1","50.0.2","50.0.3","50.1.0","50.2.0","50.3.0","50.3.1","50.3.2","51.0.0","51.1.0","51.1.0.post20201221","51.1.1","51.1.2","51.2.0","51.3.0","51.3.1","51.3.2","51.3.3","52.0.0","53.0.0","53.1.0","54.0.0","54.1.0","54.1.1","54.1.2","54.1.3","54.2.0","56.0.0","56.1.0","56.2.0","57.0.0","57.1.0","57.2.0","57.3.0","57.4.0","57.5.0","58.0.0","58.0.1","58.0.2","58.0.3","58.0.4","58.1.0","58.2.0","58.3.0","58.4.0","58.5.0","58.5.1","58.5.2","58.5.3","59.0.1","59.1.0","59.1.1","59.2.0","59.3.0","59.4.0","59.5.0","59.6.0","59.7.0","59.8.0","6.0.1","6.0.2","6.1","60.0.0","60.0.1","60.0.2","60.0.3","60.0.4","60.0.5","60.1.0","60.1.1","60.10.0","60.2.0","60.3.0","60.3.1","60.4.0","60.5.0","60.6.0","60.7.0","60.7.1","60.8.0","60.8.1","60.8.2","60.9.0","60.9.1","60.9.2","60.9.3","61.0.0","61.1.0","61.1.1","61.2.0","61.3.0","61.3.1","62.0.0","62.1.0","62.2.0","62.3.0","62.3.1","62.3.2","62.3.3","62.3.4","62.4.0","62.5.0","62.6.0","63.0.0","63.0.0b1","63.1.0","63.2.0","63.3.0","63.4.0","63.4.1","63.4.2","63.4.3","64.0.0","64.0.1","64.0.2","64.0.3","65.0.0","65.0.1","65.0.2","65.1.0","65.1.1","65.2.0","65.3.0","65.4.0","65.4.1","65.5.0","65.5.1","65.6.0","65.6.1","65.6.2","65.6.3","65.7.0","66.0.0","66.1.0","66.1.1","67.0.0","67.1.0","67.2.0","67.3.1","67.3.2","67.3.3","67.4.0","67.5.0","67.5.1","67.6.0","67.6.1","67.7.0","67.7.1","67.7.2","67.8.0","68.0.0","68.1.0","68.1.2","68.2.0","68.2.1","68.2.2","69.0.0","69.0.1","69.0.2","69.0.3","69.1.0","69.1.1","69.2.0","69.3.0","69.3.1","69.4.0","69.4.1","69.4.2","69.5.0","69.5.1","7.0","70.0.0","70.1.0","70.1.1","70.2.0","70.3.0","71.0.0","71.0.1","71.0.2","71.0.3","71.0.4","71.1.0","72.0.0","72.1.0","72.2.0","73.0.0","73.0.1","74.0.0","74.1.0","74.1.1","74.1.2","74.1.3","75.0.0","75.1.0","75.2.0","75.3.0","75.3.1","75.3.2","75.3.3","75.3.4","75.4.0","75.5.0","75.6.0","75.7.0","75.8.0","75.8.1","75.8.2","75.9.0","75.9.1","76.0.0","76.1.0","77.0.1","77.0.3","78.0.1","78.0.2","78.1.0","78.1.1","79.0.0","79.0.1","8.0","8.0.1","8.0.2","8.0.3","8.0.4","8.1","8.2","8.2.1","8.3","80.0.0","80.0.1","80.1.0","80.10.1","80.10.2","80.2.0","80.3.0","80.3.1","80.4.0","80.6.0","80.7.0","80.7.1","80.8.0","80.9.0","81.0.0","82.0.0","82.0.1","9.0","9.0.1","9.1"]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP4","package":"python-setuptools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"68.0.0-3.oe2403sp4"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"python-setuptools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"44.1.1-5.oe2003sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"python-setuptools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"59.4.0-7.oe2203sp4"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"python-setuptools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"68.0.0-3.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"python-setuptools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"68.0.0-3.oe2403sp3"}]}]},{"source":"osv","ecosystem":"PyPI","package":"setuptools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"83.0.0"}]}],"versions":["0.6b1","0.6b2","0.6b3","0.6b4","0.6c1","0.6c10","0.6c11","0.6c2","0.6c3","0.6c4","0.6c5","0.6c6","0.6c7","0.6c8","0.6c9","0.7.2","0.7.3","0.7.4","0.7.5","0.7.6","0.7.7","0.7.8","0.8","0.9","0.9.1","0.9.2","0.9.3","0.9.4","0.9.5","0.9.6","0.9.7","0.9.8","1.0","1.1","1.1.1","1.1.2","1.1.3","1.1.4","1.1.5","1.1.6","1.1.7","1.2","1.3","1.3.1","1.3.2","1.4","1.4.1","1.4.2","10.0","10.0.1","10.1","10.2","10.2.1","11.0","11.1","11.2","11.3","11.3.1","12.0","12.0.1","12.0.2","12.0.3","12.0.4","12.0.5","12.1","12.2","12.3","12.4","13.0","13.0.1","13.0.2","14.0","14.1","14.1.1","14.2","14.3","14.3.1","15.0","15.1","15.2","16.0","17.0","17.1","17.1.1","18.0","18.0.1","18.1","18.2","18.3","18.3.1","18.3.2","18.4","18.5","18.6","18.6.1","18.7","18.7.1","18.8","18.8.1","19.0","19.1","19.1.1","19.2","19.3","19.4","19.4.1","19.5","19.6","19.6.1","19.6.2","19.7","2.0","2.0.1","2.0.2","2.1","2.1.1","2.1.2","2.2","20.0","20.1","20.1.1","20.10.1","20.2.2","20.3","20.3.1","20.4","20.6.6","20.6.7","20.6.8","20.7.0","20.8.0","20.8.1","20.9.0","21.0.0","21.1.0","21.2.0","21.2.1","21.2.2","22.0.0","22.0.1","22.0.2","22.0.4","22.0.5","23.0.0","23.1.0","23.2.0","23.2.1","24.0.0","24.0.1","24.0.2","24.0.3","24.1.0","24.1.1","24.2.0","24.2.1","24.3.0","24.3.1","25.0.0","25.0.1","25.0.2","25.1.0","25.1.1","25.1.2","25.1.3","25.1.4","25.1.5","25.1.6","25.2.0","25.3.0","25.4.0","26.0.0","26.1.0","26.1.1","27.0.0","27.1.0","27.1.2","27.2.0","27.3.0","27.3.1","28.0.0","28.1.0","28.2.0","28.3.0","28.4.0","28.5.0","28.6.0","28.6.1","28.7.0","28.7.1","28.8.0","28.8.1","29.0.0","29.0.1","3.0","3.0.1","3.0.2","3.1","3.2","3.3","3.4","3.4.1","3.4.2","3.4.3","3.4.4","3.5","3.5.1","3.5.2","3.6","3.7","3.7.1","3.8","3.8.1","30.0.0","30.1.0","30.2.0","30.2.1","30.3.0","30.4.0","31.0.0","31.0.1","32.0.0","32.1.0","32.1.1","32.1.2","32.1.3","32.2.0","32.3.0","32.3.1","33.1.0","33.1.1","34.0.0","34.0.1","34.0.2","34.0.3","34.1.0","34.1.1","34.2.0","34.3.0","34.3.1","34.3.2","34.3.3","34.4.0","34.4.1","35.0.0","35.0.1","35.0.2","36.0.1","36.1.0","36.1.1","36.2.0","36.2.1","36.2.2","36.2.3","36.2.4","36.2.5","36.2.6","36.2.7","36.3.0","36.4.0","36.5.0","36.6.0","36.6.1","36.7.0","36.7.1","36.7.2","36.8.0","37.0.0","38.0.0","38.1.0","38.2.0","38.2.1","38.2.3","38.2.4","38.2.5","38.3.0","38.4.0","38.4.1","38.5.0","38.5.1","38.5.2","38.6.0","38.6.1","38.7.0","39.0.0","39.0.1","39.1.0","39.2.0","4.0","4.0.1","40.0.0","40.1.0","40.1.1","40.2.0","40.3.0","40.4.0","40.4.1","40.4.2","40.4.3","40.5.0","40.6.0","40.6.1","40.6.2","40.6.3","40.7.0","40.7.1","40.7.2","40.7.3","40.8.0","40.9.0","41.0.0","41.0.1","41.1.0","41.2.0","41.3.0","41.4.0","41.5.0","41.5.1","41.6.0","42.0.0","42.0.1","42.0.2","43.0.0","44.0.0","44.1.0","44.1.1","45.0.0","45.1.0","45.2.0","45.3.0","46.0.0","46.1.0","46.1.1","46.1.2","46.1.3","46.2.0","46.3.0","46.3.1","46.4.0","47.0.0","47.1.0","47.1.1","47.2.0","47.3.0","47.3.1","47.3.2","48.0.0","49.0.0","49.0.1","49.1.0","49.1.1","49.1.2","49.1.3","49.2.0","49.2.1","49.3.0","49.3.1","49.3.2","49.4.0","49.5.0","49.6.0","5.0","5.0.1","5.0.2","5.1","5.2","5.3","5.4","5.4.1","5.4.2","5.5","5.5.1","5.6","5.7","5.8","50.0.0","50.0.1","50.0.2","50.0.3","50.1.0","50.2.0","50.3.0","50.3.1","50.3.2","51.0.0","51.1.0","51.1.0.post20201221","51.1.1","51.1.2","51.2.0","51.3.0","51.3.1","51.3.2","51.3.3","52.0.0","53.0.0","53.1.0","54.0.0","54.1.0","54.1.1","54.1.2","54.1.3","54.2.0","56.0.0","56.1.0","56.2.0","57.0.0","57.1.0","57.2.0","57.3.0","57.4.0","57.5.0","58.0.0","58.0.1","58.0.2","58.0.3","58.0.4","58.1.0","58.2.0","58.3.0","58.4.0","58.5.0","58.5.1","58.5.2","58.5.3","59.0.1","59.1.0","59.1.1","59.2.0","59.3.0","59.4.0","59.5.0","59.6.0","59.7.0","59.8.0","6.0.1","6.0.2","6.1","60.0.0","60.0.1","60.0.2","60.0.3","60.0.4","60.0.5","60.1.0","60.1.1","60.10.0","60.2.0","60.3.0","60.3.1","60.4.0","60.5.0","60.6.0","60.7.0","60.7.1","60.8.0","60.8.1","60.8.2","60.9.0","60.9.1","60.9.2","60.9.3","61.0.0","61.1.0","61.1.1","61.2.0","61.3.0","61.3.1","62.0.0","62.1.0","62.2.0","62.3.0","62.3.1","62.3.2","62.3.3","62.3.4","62.4.0","62.5.0","62.6.0","63.0.0","63.0.0b1","63.1.0","63.2.0","63.3.0","63.4.0","63.4.1","63.4.2","63.4.3","64.0.0","64.0.1","64.0.2","64.0.3","65.0.0","65.0.1","65.0.2","65.1.0","65.1.1","65.2.0","65.3.0","65.4.0","65.4.1","65.5.0","65.5.1","65.6.0","65.6.1","65.6.2","65.6.3","65.7.0","66.0.0","66.1.0","66.1.1","67.0.0","67.1.0","67.2.0","67.3.1","67.3.2","67.3.3","67.4.0","67.5.0","67.5.1","67.6.0","67.6.1","67.7.0","67.7.1","67.7.2","67.8.0","68.0.0","68.1.0","68.1.2","68.2.0","68.2.1","68.2.2","69.0.0","69.0.1","69.0.2","69.0.3","69.1.0","69.1.1","69.2.0","69.3.0","69.3.1","69.4.0","69.4.1","69.4.2","69.5.0","69.5.1","7.0","70.0.0","70.1.0","70.1.1","70.2.0","70.3.0","71.0.0","71.0.1","71.0.2","71.0.3","71.0.4","71.1.0","72.0.0","72.1.0","72.2.0","73.0.0","73.0.1","74.0.0","74.1.0","74.1.1","74.1.2","74.1.3","75.0.0","75.1.0","75.2.0","75.3.0","75.3.1","75.3.2","75.3.3","75.3.4","75.4.0","75.5.0","75.6.0","75.7.0","75.8.0","75.8.1","75.8.2","75.9.0","75.9.1","76.0.0","76.1.0","77.0.1","77.0.3","78.0.1","78.0.2","78.1.0","78.1.1","79.0.0","79.0.1","8.0","8.0.1","8.0.2","8.0.3","8.0.4","8.1","8.2","8.2.1","8.3","80.0.0","80.0.1","80.1.0","80.10.1","80.10.2","80.2.0","80.3.0","80.3.1","80.4.0","80.6.0","80.7.0","80.7.1","80.8.0","80.9.0","81.0.0","82.0.0","82.0.1","9.0","9.0.1","9.1"]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"python-setuptools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:83.0.0-4.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"python-setuptools-wheel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:83.0.0-4.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"python3-setuptools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:83.0.0-4.hum1"}]}]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"setuptools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["45.2.0-1","45.2.0-1ubuntu0.1","45.2.0-1ubuntu0.2","45.2.0-1ubuntu0.3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"setuptools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["52.0.0-4","58.2.0-1","59.6.0-1.2","59.6.0-1.2ubuntu0.22.04.1","59.6.0-1.2ubuntu0.22.04.2","59.6.0-1.2ubuntu0.22.04.3"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"setuptools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["68.1.2-2","68.1.2-2ubuntu1","68.1.2-2ubuntu1.1","68.1.2-2ubuntu1.2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"setuptools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["75.8.0-1","78.1.0-1.2","78.1.1-0.1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"setuptools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["78.1.1-0.1build1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"setuptools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["78.1.1-0.1","78.1.1-0.1build1"]}],"products":[{"vendor":"pypa","product":"setuptools"},{"vendor":"python","product":"setuptools"}],"references":[{"url":"https://github.com/pypa/setuptools/security/advisories/GHSA-h35f-9h28-mq5c","tags":["x_refsource_CONFIRM","exploit","Exploit","Vendor Advisory","Mitigation","advisory","web","evidence","article","report"]},{"url":"https://github.com/pypa/setuptools/commit/dd9f436a36486b4cb8a4c70a2321548b0be09b8f","tags":["x_refsource_MISC","Patch","fix","web","article"]},{"url":"https://github.com/pypa/setuptools/releases/tag/v83.0.0","tags":["x_refsource_MISC","Release Notes","article","web","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59890","tags":["web","advisory"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/setuptools/PYSEC-2026-3447.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-h35f-9h28-mq5c"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-59890","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1786468462.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59890.json","tags":["advisory"]},{"url":"https://github.com/pypa/setuptools","tags":["package"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3191","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:37530","tags":["advisory"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-59890","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_37530.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2498155","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-59890","tags":["advisory","report"]},{"url":"https://ubuntu.com/security/CVE-2026-59890","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-59890","title":"setuptools: MANIFEST.in exclusion bypass in sdist via Unicode normalization collision (NFC/NFD) on macOS APFS/HFS+","description":"setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. Prior to 83.0.0, FileList applied MANIFEST.in exclude, global-exclude, recursive-exclude, and prune directives by matching compiled glob patterns against on-disk file names without Unicode normalization, so on macOS APFS or HFS+ an NFD file name could bypass an NFC exclusion rule and be packed into a source distribution. This issue is fixed in version 83.0.0.","status":"published","published":"2026-07-08T16:02:07.519Z","modified":"2026-07-08T16:44:52.269Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-176","CWE-697"],"updated_at":"2026-11-02T14:19:58.560602Z"}],"euvd":[{"id":"EUVD-2026-42323","description":"setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. Prior to 83.0.0, FileList applied MANIFEST.in exclude, global-exclude, recursive-exclude, and prune directives by matching compiled glob patterns against on-disk file names without Unicode normalization, so on macOS APFS or HFS+ an NFD file name could bypass an NFC exclusion rule and be packed into a source distribution. This issue is fixed in version 83.0.0.","status":"published","published":"2026-07-08T16:02:07Z","modified":"2026-07-08T16:44:52Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T18:20:10.578977Z"}],"ghsa":[{"id":"GHSA-h35f-9h28-mq5c","title":"setuptools: MANIFEST.in exclusion bypass in sdist via Unicode normalization collision (NFC/NFD) on macOS APFS/HFS+","description":"## Summary\n\nWhen building a source distribution (`python -m build --sdist` / `setup.py sdist`), setuptools' `FileList` applies `MANIFEST.in` directives (`exclude`, `global-exclude`, `recursive-exclude`, `prune`) by matching a compiled glob against on-disk file names **byte-for-byte, with no Unicode normalization**. On normalization-preserving filesystems (notably macOS APFS and HFS+), a file written in NFD and a `MANIFEST.in` rule written in NFC refer to the same file but are byte-distinct, so the exclusion silently fails to match. A file the maintainer intended to exclude is then packed into the `.tar.gz` and, if published, uploaded to the public, immutable PyPI index.\n\n## Details\n\nFile names in `FileList.files` come from `os.walk` (`setuptools/_distutils/filelist.py`, `_find_all_simple`), so on APFS a file written NFD is offered to the matcher in NFD, while the `MANIFEST.in` pattern carries the author's editor form (typically NFC). The matching path performs no canonicalization:\n\n```python\n# setuptools/command/egg_info.py  (FileList.global_exclude)\ndef global_exclude(self, pattern):\n    match = translate_pattern(os.path.join('**', pattern))   # fnmatch.translate -\u003e regex, no NFC/NFD\n    return self._remove_files(match.match)                   # byte-level regex over raw os.walk names\n```\n\nA rule written NFC (`café` = `63 61 66 c3 a9`) does not match an on-disk name written NFD (`café` = `63 61 66 65 cc 81`), even though the filesystem treats the two as one file.\n\nA `unicodedata.normalize('NFD', ...)` helper exists in `setuptools/unicode_utils.py` (`decompose()`), but it is **never called in the manifest matching path**, so neither the pattern nor the walked path is normalized before matching. The only normalization in this area, `EggInfoCommand._manifest_normalize`, uses `filesys_decode` (bytes→str decode only, no NFC/NFD) and runs when writing `SOURCES.txt`, after matching has already occurred.\n\n## Impact\n\n`MANIFEST.in` exclusions are the documented mechanism maintainers use to keep secrets, local configs, and private fixtures out of the published sdist. A non-ASCII excluded file may be published to the public, immutable PyPI index despite the rule — an irreversible disclosure with no visual cue (NFC and NFD forms render identically). Exposure is filesystem-dependent and most relevant on macOS APFS/HFS+, where many maintainers build and publish. Pure-ASCII rules are unaffected.\n\n## Proof of concept\n\nWith a project containing `MANIFEST.in`:\n\n```\nglobal-include *.txt *.json\nglobal-exclude secret_café.txt    # rule saved NFC\n```\n\nand an on-disk file `secret_café.txt` written in NFD, `python -m build --sdist` packs the secret file into the resulting `.tar.gz`, while an ASCII control file excluded by the same directive is correctly dropped — isolating the bypass to the NFC-pattern vs. NFD-name mismatch. Reproduced on macOS APFS with setuptools 82.0.1.\n\n## Remediation\n\nNormalize both the walked path and each `MANIFEST.in` pattern to a single canonical form before matching, in both `setuptools/command/egg_info.py` (`FileList`) and the vendored `setuptools/_distutils/filelist.py`. For an exclusion list, err toward excluding more, and document that `MANIFEST.in` matching is normalization-insensitive on macOS.\n\n## Credit\n\nReported by Tomas Illuminati. Coordinated via CERT/CC VINCE VU#604762.","status":"published","published":"2026-07-21T19:09:21Z","modified":"2026-07-21T19:09:21Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N","level":"medium"}],"cwes":["CWE-176","CWE-697"],"updated_at":"2026-11-02T14:40:50.444681Z"}],"nvd":[{"id":"CVE-2026-59890","description":"setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. Prior to 83.0.0, FileList applied MANIFEST.in exclude, global-exclude, recursive-exclude, and prune directives by matching compiled glob patterns against on-disk file names without Unicode normalization, so on macOS APFS or HFS+ an NFD file name could bypass an NFC exclusion rule and be packed into a source distribution. This issue is fixed in version 83.0.0.","status":"published","published":"2026-07-08T17:17:27.02Z","modified":"2026-10-25T17:10:00.197Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-176","CWE-697"],"updated_at":"2026-11-02T14:12:28.040501Z"}],"osv":[{"id":"BELL-CVE-2026-59890","status":"published","published":"2026-07-11T06:02:57.286481Z","modified":"2026-08-01T07:15:11.294532057Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:28:24.657778Z"},{"id":"CVE-2026-59890","title":"setuptools: MANIFEST.in exclusion bypass in sdist via Unicode normalization collision (NFC/NFD) on macOS APFS/HFS+","description":"setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. Prior to 83.0.0, FileList applied MANIFEST.in exclude, global-exclude, recursive-exclude, and prune directives by matching compiled glob patterns against on-disk file names without Unicode normalization, so on macOS APFS or HFS+ an NFD file name could bypass an NFC exclusion rule and be packed into a source distribution. This issue is fixed in version 83.0.0.","status":"published","published":"2026-07-08T16:02:07.519Z","modified":"2026-10-28T02:31:12.811326465Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N","level":"medium"}],"cwes":["CWE-176","CWE-697"],"updated_at":"2026-11-02T15:45:12.496548Z"},{"id":"GHSA-h35f-9h28-mq5c","title":"setuptools: MANIFEST.in exclusion bypass in sdist via Unicode normalization collision (NFC/NFD) on macOS APFS/HFS+","description":"## Summary\n\nWhen building a source distribution (`python -m build --sdist` / `setup.py sdist`), setuptools' `FileList` applies `MANIFEST.in` directives (`exclude`, `global-exclude`, `recursive-exclude`, `prune`) by matching a compiled glob against on-disk file names **byte-for-byte, with no Unicode normalization**. On normalization-preserving filesystems (notably macOS APFS and HFS+), a file written in NFD and a `MANIFEST.in` rule written in NFC refer to the same file but are byte-distinct, so the exclusion silently fails to match. A file the maintainer intended to exclude is then packed into the `.tar.gz` and, if published, uploaded to the public, immutable PyPI index.\n\n## Details\n\nFile names in `FileList.files` come from `os.walk` (`setuptools/_distutils/filelist.py`, `_find_all_simple`), so on APFS a file written NFD is offered to the matcher in NFD, while the `MANIFEST.in` pattern carries the author's editor form (typically NFC). The matching path performs no canonicalization:\n\n```python\n# setuptools/command/egg_info.py  (FileList.global_exclude)\ndef global_exclude(self, pattern):\n    match = translate_pattern(os.path.join('**', pattern))   # fnmatch.translate -\u003e regex, no NFC/NFD\n    return self._remove_files(match.match)                   # byte-level regex over raw os.walk names\n```\n\nA rule written NFC (`café` = `63 61 66 c3 a9`) does not match an on-disk name written NFD (`café` = `63 61 66 65 cc 81`), even though the filesystem treats the two as one file.\n\nA `unicodedata.normalize('NFD', ...)` helper exists in `setuptools/unicode_utils.py` (`decompose()`), but it is **never called in the manifest matching path**, so neither the pattern nor the walked path is normalized before matching. The only normalization in this area, `EggInfoCommand._manifest_normalize`, uses `filesys_decode` (bytes→str decode only, no NFC/NFD) and runs when writing `SOURCES.txt`, after matching has already occurred.\n\n## Impact\n\n`MANIFEST.in` exclusions are the documented mechanism maintainers use to keep secrets, local configs, and private fixtures out of the published sdist. A non-ASCII excluded file may be published to the public, immutable PyPI index despite the rule — an irreversible disclosure with no visual cue (NFC and NFD forms render identically). Exposure is filesystem-dependent and most relevant on macOS APFS/HFS+, where many maintainers build and publish. Pure-ASCII rules are unaffected.\n\n## Proof of concept\n\nWith a project containing `MANIFEST.in`:\n\n```\nglobal-include *.txt *.json\nglobal-exclude secret_café.txt    # rule saved NFC\n```\n\nand an on-disk file `secret_café.txt` written in NFD, `python -m build --sdist` packs the secret file into the resulting `.tar.gz`, while an ASCII control file excluded by the same directive is correctly dropped — isolating the bypass to the NFC-pattern vs. NFD-name mismatch. Reproduced on macOS APFS with setuptools 82.0.1.\n\n## Remediation\n\nNormalize both the walked path and each `MANIFEST.in` pattern to a single canonical form before matching, in both `setuptools/command/egg_info.py` (`FileList`) and the vendored `setuptools/_distutils/filelist.py`. For an exclusion list, err toward excluding more, and document that `MANIFEST.in` matching is normalization-insensitive on macOS.\n\n## Credit\n\nReported by Tomas Illuminati. Coordinated via CERT/CC VINCE VU#604762.","status":"published","published":"2026-07-21T19:09:21Z","modified":"2026-09-10T03:50:52.323347787Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N","level":"medium"}],"cwes":["CWE-176","CWE-697"],"updated_at":"2026-11-02T15:46:48.546324Z"},{"id":"OESA-2026-3191","title":"python-setuptools security update","description":"Setuptools is a collection of enhancements to the Python distutils that allow you to more easily build and distribute Python packages, especially ones that have dependencies on other packages.\r\n\r\nSecurity Fix(es):\n\nsetuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. Prior to 83.0.0, FileList applied MANIFEST.in exclude, global-exclude, recursive-exclude, and prune directives by matching compiled glob patterns against on-disk file names without Unicode normalization, so on macOS APFS or HFS+ an NFD file name could bypass an NFC exclusion rule and be packed into a source distribution. This issue is fixed in version 83.0.0.(CVE-2026-59890)","status":"published","published":"2026-08-01T11:12:04Z","modified":"2026-08-18T01:21:24.810167172Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:46.823443Z"},{"id":"PYSEC-2026-3447","description":"setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. Prior to 83.0.0, FileList applied MANIFEST.in exclude, global-exclude, recursive-exclude, and prune directives by matching compiled glob patterns against on-disk file names without Unicode normalization, so on macOS APFS or HFS+ an NFD file name could bypass an NFC exclusion rule and be packed into a source distribution. This issue is fixed in version 83.0.0.","status":"published","published":"2026-07-08T17:17:27.02Z","modified":"2026-07-14T10:56:37.948360943Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:56.847083Z"},{"id":"RHSA-2026:37530","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-07-16T10:09:39Z","modified":"2026-10-16T10:16:41Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:20.491441Z"},{"id":"UBUNTU-CVE-2026-59890","description":"setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. Prior to 83.0.0, FileList applied MANIFEST.in exclude, global-exclude, recursive-exclude, and prune directives by matching compiled glob patterns against on-disk file names without Unicode normalization, so on macOS APFS or HFS+ an NFD file name could bypass an NFC exclusion rule and be packed into a source distribution. This issue is fixed in version 83.0.0.","status":"published","published":"2026-07-08T17:17:00Z","modified":"2026-10-17T12:59:14.459501363Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T16:56:41.911783Z"},{"id":"AZL-110366","title":"CVE-2026-59890 affecting package setuptool 1.19.11-23","description":"setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. Prior to 83.0.0, FileList applied MANIFEST.in exclude, global-exclude, recursive-exclude, and prune directives by matching compiled glob patterns against on-disk file names without Unicode normalization, so on macOS APFS or HFS+ an NFD file name could bypass an NFC exclusion rule and be packed into a source distribution. This issue is fixed in version 83.0.0.","status":"published","published":"2026-07-08T17:17:27Z","modified":"2026-11-05T05:36:30Z","updated_at":"2026-11-05T16:41:18.42484Z"},{"id":"AZL-92229","title":"CVE-2026-59890 affecting package python-setuptools for versions less than 69.0.3-6","description":"setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. Prior to 83.0.0, FileList applied MANIFEST.in exclude, global-exclude, recursive-exclude, and prune directives by matching compiled glob patterns against on-disk file names without Unicode normalization, so on macOS APFS or HFS+ an NFD file name could bypass an NFC exclusion rule and be packed into a source distribution. This issue is fixed in version 83.0.0.","status":"published","published":"2026-07-08T17:17:27Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:25.880689Z"},{"id":"BIT-setuptools-2026-59890","title":"setuptools: MANIFEST.in exclusion bypass in sdist via Unicode normalization collision (NFC/NFD) on macOS APFS/HFS+","description":"setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. Prior to 83.0.0, FileList applied MANIFEST.in exclude, global-exclude, recursive-exclude, and prune directives by matching compiled glob patterns against on-disk file names without Unicode normalization, so on macOS APFS or HFS+ an NFD file name could bypass an NFC exclusion rule and be packed into a source distribution. This issue is fixed in version 83.0.0.","status":"published","published":"2026-07-14T08:55:22.983Z","modified":"2026-09-08T08:48:19.342109152Z","updated_at":"2026-11-02T15:28:35.111822Z"},{"id":"CLSA-2026-1786468462","title":"python-setuptools: Fix of CVE-2026-59890","description":"- CVE-2026-59890: normalize Unicode form (NFC) on both the MANIFEST.in\n  pattern and the candidate path before matching, so an exclude directive\n  cannot be bypassed by a decomposed (NFD) file name","status":"published","published":"2026-08-11T17:14:40Z","modified":"2026-10-26T09:30:34.045721214Z","updated_at":"2026-11-02T15:43:46.850893Z"},{"id":"CLSA-2026-1787028610","title":"TuxCare security update for setuptools (1 CVE)","description":"TuxCare rebuilt setuptools to address 1 CVE. Fixed in 75.8.0.post2+tuxcare.","status":"published","published":"2026-08-18T04:50:10Z","modified":"2026-10-15T09:48:05.527597084Z","updated_at":"2026-11-02T15:43:47.20725Z"},{"id":"CLSA-2026-1787559705","title":"TuxCare security update for setuptools (1 CVE)","description":"TuxCare rebuilt setuptools to address 1 CVE. Fixed in 75.3.2.post1+tuxcare.","status":"published","published":"2026-08-24T08:21:45Z","modified":"2026-10-15T09:48:05.869146372Z","updated_at":"2026-11-02T15:43:47.20725Z"},{"id":"CLSA-2026-1790749457","title":"TuxCare security update for setuptools (1 CVE)","description":"TuxCare rebuilt setuptools to address 1 CVE. Fixed in 75.0.0.post2+tuxcare.","status":"published","published":"2026-09-30T06:24:17Z","modified":"2026-10-15T09:48:02.330081778Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"CLSA-2026-1791273613","title":"TuxCare security update for setuptools (2 CVEs)","description":"TuxCare rebuilt setuptools to address 2 CVEs. Fixed in 65.5.1.post2+tuxcare.","status":"published","published":"2026-10-06T08:00:13Z","modified":"2026-10-15T09:46:33.733405001Z","updated_at":"2026-11-02T15:43:49.016976Z"},{"id":"CLSA-2026-1791274242","title":"TuxCare security update for setuptools (2 CVEs)","description":"TuxCare rebuilt setuptools to address 2 CVEs. Fixed in 60.0.0.post3+tuxcare.","status":"published","published":"2026-10-06T08:10:42Z","modified":"2026-10-15T09:46:21.714224928Z","updated_at":"2026-11-02T15:43:49.016976Z"},{"id":"CLSA-2026-1791275059","title":"TuxCare security update for setuptools (3 CVEs)","description":"TuxCare rebuilt setuptools to address 3 CVEs. Fixed in 59.8.0.post2+tuxcare.","status":"published","published":"2026-10-06T08:24:19Z","modified":"2026-10-15T09:48:07.297525303Z","updated_at":"2026-11-02T15:43:49.016976Z"},{"id":"CLSA-2026-1791366380","title":"TuxCare security update for setuptools (1 CVE)","description":"TuxCare rebuilt setuptools to address 1 CVE. Fixed in 70.3.0.post2+tuxcare.","status":"published","published":"2026-10-07T09:46:20Z","modified":"2026-10-15T09:48:07.300624682Z","updated_at":"2026-11-02T15:43:49.016976Z"},{"id":"CLSA-2026-1791366704","title":"TuxCare security update for setuptools (1 CVE)","description":"TuxCare rebuilt setuptools to address 1 CVE. Fixed in 68.0.0.post2+tuxcare.","status":"published","published":"2026-10-07T09:51:44Z","modified":"2026-10-15T09:48:07.221071708Z","updated_at":"2026-11-02T15:43:49.016976Z"}]}}