Vulnerabilities for setuptools

First version without a known vulnerability: 83.0.0

Details

• GHSA-h35f-9h28-mq5c2026-07-21

  setuptools: MANIFEST.in exclusion bypass in sdist via Unicode normalization collision (NFC/NFD) on macOS APFS/HFS+

  Fixed in: 83.0.0

• GHSA-5rjg-fvgr-3xxf2025-05-19

  setuptools has a path traversal vulnerability in PackageIndex.download that leads to Arbitrary File Write

  Fixed in: 78.1.1, 250a6d17978f9f6ac3ac887091f2d32886fbbb0b

• GHSA-cx63-2mw6-8hw52024-07-15

  setuptools vulnerable to Command Injection via package URL

  Fixed in: 70.0.0

• GHSA-r9hx-vwmv-q5792022-12-23

  pypa/setuptools vulnerable to Regular Expression Denial of Service (ReDoS)

  Fixed in: 65.5.1, 43a9c9bfa6aa626ec2a22540bea28d2ca77964be

• GHSA-27x4-j476-jp5f2022-05-17

  Setuptools vulnerable to Man-in-the-middle attacks

  Fixed in: 0.7