CVE-2026-59890 Details
Description
setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. Prior to 83.0.0, FileList applied MANIFEST.in exclude, global-exclude, recursive-exclude, and prune directives by matching compiled glob patterns against on-disk file names without Unicode normalization, so on macOS APFS or HFS+ an NFD file name could bypass an NFC exclusion rule and be packed into a source distribution. This issue is fixed in version 83.0.0.
A vulnerability in setuptools prior to version 83.0.0 allows for a bypass of exclusion rules defined in MANIFEST.in when building source distributions on macOS. The issue arises because the FileList component applies exclusion directives by matching compiled glob patterns against file names on disk without normalizing Unicode. As a result, a file named using the NFD (Normalization Form Decomposed) can evade an exclusion rule written in NFC (Normalization Form Composed), leading to unintended files being included in the source distribution.
Users can update to setuptools version 83.0.0 or later, where this vulnerability has been fixed. In the patched version, the Unicode normalization issue has been addressed, ensuring that MANIFEST.in exclusion rules are properly applied regardless of how file names are encoded.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/pypa/setuptools/security/advisories/GHSA-h35f-9h28-mq5c | CISA-ADP | ExploitVendor AdvisoryMitigation |
| https://github.com/pypa/setuptools/commit/dd9f436a36486b4cb8a4c70a2321548b0be09b8f | [email protected] | Patch |
| https://github.com/pypa/setuptools/releases/tag/v83.0.0 | [email protected] | Release Notes |
| https://github.com/pypa/setuptools/security/advisories/GHSA-h35f-9h28-mq5c | [email protected] | ExploitVendor AdvisoryMitigation |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-176 | Improper Handling of Unicode Encoding | [email protected] |
| CWE-697 | Incorrect Comparison | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| python setuptools | < 83.0.0 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 13, 2026 | Initial Analysis | [email protected] |
| Jul 8, 2026 | New CVE Received | [email protected] |
| Jul 8, 2026 | CVE Modified | CISA-ADP |