Repository navigation
Update dependency setuptools to v84 [SECURITY] - #392
Open
renovate[bot] wants to merge 1 commit into
Open
renovate[bot] wants to merge 1 commit into
renovate[bot] wants to merge 1 commit into
Conversation
Contributor
Author
|
renovate
Bot
force-pushed
the
renovate/pypi-setuptools-vulnerability
branch
2 times, most recently
from
August 26, 2026 09:29
6dbf7c8 to
5354c40
Compare
renovate
Bot
force-pushed
the
renovate/pypi-setuptools-vulnerability
branch
2 times, most recently
from
September 9, 2026 15:53
f740a71 to
fa3c13b
Compare
renovate
Bot
force-pushed
the
renovate/pypi-setuptools-vulnerability
branch
from
September 17, 2026 13:05
fa3c13b to
3818125
Compare
renovate
Bot
force-pushed
the
renovate/pypi-setuptools-vulnerability
branch
from
October 30, 2026 23:39
3818125 to
b4f60dc
Compare
renovate
Bot
changed the title
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
^79.0.0→^84.0.0setuptools: MANIFEST.in exclusion bypass in sdist via Unicode normalization collision (NFC/NFD) on macOS APFS/HFS+
CVE-2026-59890 / GHSA-h35f-9h28-mq5c
More information
Details
Summary
When building a source distribution (
python -m build --sdist/setup.py sdist), setuptools'FileListappliesMANIFEST.indirectives (exclude,global-exclude,recursive-exclude,prune) by matching a compiled glob against on-disk file names byte-for-byte, with no Unicode normalization. On normalization-preserving filesystems (notably macOS APFS and HFS+), a file written in NFD and aMANIFEST.inrule written in NFC refer to the same file but are byte-distinct, so the exclusion silently fails to match. A file the maintainer intended to exclude is then packed into the.tar.gzand, if published, uploaded to the public, immutable PyPI index.Details
File names in
FileList.filescome fromos.walk(setuptools/_distutils/filelist.py,_find_all_simple), so on APFS a file written NFD is offered to the matcher in NFD, while theMANIFEST.inpattern carries the author's editor form (typically NFC). The matching path performs no canonicalization:A rule written NFC (
café=63 61 66 c3 a9) does not match an on-disk name written NFD (café=63 61 66 65 cc 81), even though the filesystem treats the two as one file.A
unicodedata.normalize('NFD', ...)helper exists insetuptools/unicode_utils.py(decompose()), but it is never called in the manifest matching path, so neither the pattern nor the walked path is normalized before matching. The only normalization in this area,EggInfoCommand._manifest_normalize, usesfilesys_decode(bytes→str decode only, no NFC/NFD) and runs when writingSOURCES.txt, after matching has already occurred.Impact
MANIFEST.inexclusions are the documented mechanism maintainers use to keep secrets, local configs, and private fixtures out of the published sdist. A non-ASCII excluded file may be published to the public, immutable PyPI index despite the rule — an irreversible disclosure with no visual cue (NFC and NFD forms render identically). Exposure is filesystem-dependent and most relevant on macOS APFS/HFS+, where many maintainers build and publish. Pure-ASCII rules are unaffected.Proof of concept
With a project containing
MANIFEST.in:and an on-disk file
secret_café.txtwritten in NFD,python -m build --sdistpacks the secret file into the resulting.tar.gz, while an ASCII control file excluded by the same directive is correctly dropped — isolating the bypass to the NFC-pattern vs. NFD-name mismatch. Reproduced on macOS APFS with setuptools 82.0.1.Remediation
Normalize both the walked path and each
MANIFEST.inpattern to a single canonical form before matching, in bothsetuptools/command/egg_info.py(FileList) and the vendoredsetuptools/_distutils/filelist.py. For an exclusion list, err toward excluding more, and document thatMANIFEST.inmatching is normalization-insensitive on macOS.Credit
Reported by Tomas Illuminati. Coordinated via CERT/CC VINCE VU#604762.
Severity
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
setuptools: Windows path escape via namespace_packages.txt during legacy wheel installation Description
GHSA-xmj3-9gf7-h52w
More information
Details
Summary
On Windows, attacker-controlled content in a wheel's
.dist-info/namespace_packages.txtcan cause setuptools' legacy wheelinstallation path to create an
__init__.pyoutside the requesteddestination_eggdir.The attacker can influence the destination path, but not the contents of
the created file.
Details
Tested setuptools commit:
6ead555c5fb29bc57fe6105b1bffc163f56fd558Relevant source:
setuptools/wheel.pySHA-256:
359b7e0d5dd8c3135653abe08a8ed5dc0352eadfd7df22cb5e2b5303b7c3cafdThe relevant call path is:
Wheel(wheel_path).install_as_egg(destination)→
_install_as_egg→
_convert_metadata→
_fix_namespace_packagesA wheel can provide attacker-controlled content in:
<distribution>.dist-info/namespace_packages.txtThe namespace value is eventually used approximately as:
A synthetic wheel was created containing:
demo_pkg-1.0.dist-info/namespace_packages.txtwhose content was the absolute path of:
sandbox\outsideThe real acquired setuptools implementation was then invoked:
The operation completed without exception.
Expected metadata was created under:
sandbox\destination\EGG-INFObut setuptools also created:
sandbox\outside\__init__.pyThe file did not exist before execution.
Its contents were:
The unrelated canary remained byte-identical.
The sandbox was deleted after recording the evidence.