Skip to main content
cve.nowby Sazabi
← PyPI
PyPIPackage

setuptools

6 known vulnerabilities (2 high, 2 medium, 1 low), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
6 · 2 high, 2 medium, 1 low
Registry
PyPI

Advisories 6

  • setuptools: Windows path escape via namespace_packages.txt during legacy wheel installation Description

    Affected: from 38.2.2, fixed in 84.1.0.

  • CVE-2026-59890Medium 6.1

    setuptools: MANIFEST.in exclusion bypass in sdist via Unicode normalization collision (NFC/NFD) on macOS APFS/HFS+

    Affected: fixed in 83.0.0.

  • setuptools has a path traversal vulnerability in PackageIndex.download that leads to Arbitrary File Write

    Affected: fixed in 78.1.1; fixed in 78.1.1.

  • Remote Code Execution in pypa/setuptools

    Affected: fixed in 70.0.0.

  • CVE-2022-40897Medium 5.9

    Python Packaging Authority (PyPA) setuptools before 65.5.1 allows remote attackers to cause a denial of service via HTML in a crafted…

    Affected: fixed in 65.5.1; fixed in 65.5.1.

  • easy_install in setuptools before 0.7 uses HTTP to retrieve packages from the PyPI repository, and does not perform integrity checks on…

    Affected: fixed in 0.7.