CyberRota Analysis
AI-GeneratedSetuptools versions prior to 83.0.0 are vulnerable to a file exclusion bypass due to improper handling of Unicode normalization, allowing certain file names on macOS file systems to evade exclusion rules. This could lead to unintended files being included in source distributions, potentially exposing sensitive data or introducing malicious code. Developers and organizations using setuptools for Python package management should prioritize upgrading to version 83.0.0 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. Prior to 83.0.0, FileList applied MANIFEST.in exclude, global-exclude, recursive-exclude, and prune directives by matching compiled glob patterns against on-disk file names without Unicode normalization, so on macOS APFS or HFS+ an NFD file name could bypass an NFC exclusion rule and be packed into a source distribution. This issue is fixed in version 83.0.0.
Related CVEs
Other vulnerabilities affecting the same vendor(s)