CVE-2026-59890
Published: July 11, 2026Last modified: August 1, 2026
Description
setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. Prior to 83.0.0, FileList applied MANIFEST.in exclude, global-exclude, recursive-exclude, and prune directives by matching compiled glob patterns against on-disk file names without Unicode normalization, so on macOS APFS or HFS+ an NFD file name could bypass an NFC exclusion rule and be packed into a source distribution. This issue is fixed in version 83.0.0.
Severity score breakdown
| Parameter | Value |
|---|---|
| Base score | 6.1 |
| Attack Vector | LOCAL |
| Attack complexity | LOW |
| Privileges required | NONE |
| User interaction | REQUIRED |
| Scope | UNCHANGED |
| Confidentiality | HIGH |
| Integrity impact | LOW |
| Availability impact | NONE |
| Vector | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N |
Status
| Product | Release | Package | Status |
|---|---|---|---|
| Alpaquita Linux | 23 LTS | py3-setuptools | Unknown (65.6.0-r1) |
| 25 LTS | py3-setuptools | Unknown (80.9.0-r0) | |
| Stream | py3-setuptools | Fixed (83.0.0-r0) | |
| Hardened Containers | 23 LTS | py3-setuptools | Unknown (65.6.0-r1) |
| 25 LTS | py3-setuptools | Unknown (80.9.0-r0) | |
| Stream | py3-setuptools | Fixed (83.0.0-r0) |