https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T22:03:11.224251+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bell-cve-2026-59890 BELL-CVE-2026-59890 2026-10-03T22:03:11.325354+00:00

Affected: Alpaquita:stream: py3-setuptools, BellSoft Hardened Containers:stream: py3-setuptools

 https://cve.radiocsirt.org/vuln/bit-setuptools-2026-59890 BIT-setuptools-2026-59890 — setuptools: MANIFEST.in exclusion bypass in sdist via Unicode normalization collision (NFC/NFD) on macOS APFS/HFS+ 2026-10-03T22:03:11.325442+00:00

Affected: Bitnami: setuptools

setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. Prior to 83.0.0, FileList applied MANIFEST.in exclude, global-exclude, recursive-exclude, and prune directives by matching compiled glob patterns against on-disk file names without Unicode normalization, so on macOS APFS or HFS+ an NFD file name could bypass an NFC exclusion rule and be packed into a source distribution. This issue is fixed in version 83.0.0.

 https://cve.radiocsirt.org/vuln/brew-ansible-builder-cve-2026-59890 BREW-ansible-builder-CVE-2026-59890 — setuptools: MANIFEST.in exclusion bypass in sdist via Unicode normalization collision (NFC/NFD) on macOS APFS/HFS+ 2026-10-03T22:03:11.325473+00:00

Affected: Homebrew: ansible-builder

## Summary

When building a source distribution (`python -m build --sdist` / `setup.py sdist`), setuptools' `FileList` applies `MANIFEST.in` directives (`exclude`, `global-exclude`, `recursive-exclude`, `prune`) by matching a compiled glob against on-disk file names **byte-for-byte, with no Unicode normalization**. On normalization-preserving filesystems (notably macOS APFS and HFS+), a file written in NFD and a `MANIFEST.in` rule written in NFC refer to the same file but are byte-distinct, so the exclusion silently fails to match. A file the maintainer intended to exclude is then packed into the `.tar.gz` and, if published, uploaded to the public, immutable PyPI index.

## Details

File names in `FileList.files` come from `os.walk` (`setuptools/_distutils/filelist.py`, `_find_all_simple`), so on APFS a file written NFD is offered to the matcher in NFD, while the `MANIFEST.in` pattern carries the author's editor form (typically NFC). The matching path performs no canonicalization:

```python # setuptools/command/egg_info.py (FileList.global_exclude) def global_exclude(self, pattern): match = translate_pattern(os.path.join('**', pattern)) # fnmatch.translate -> regex, no NFC/NFD return self._remove_files(match.match) # byte-level regex over raw os.walk names ```

A rule written NFC (`café` = `63 61 66 c3 a9`) does not match an on-disk name written NFD (`café` = `63 61 66 65 cc 81`), even though the filesystem treats the two as one file.

A `unicod…

 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0873 certfr-2026-avi-0873 — De multiples vulnérabilités ont été découvertes dans Microsoft Azure Linux. Elles permettent à un attaquant de provoque… 2026-10-03T22:03:11.325529+00:00 certfr-2026-avi-0873 https://cve.radiocsirt.org/vuln/cleanstart-2026-bc02149 Withdrawn: CLEANSTART-2026-BC02149 — Security fixes in airflow-3 3.1.8-r6 2026-10-03T22:03:11.325547+00:00

Withdrawn by the publisher.

Affected: CleanStart: airflow-3

Package airflow-3 version 3.1.8-r6 fixes 13 vulnerabilities: CVE-2026-53533, CVE-2026-59885, CVE-2026-59886, CVE-2026-59890, CVE-2026-49476...

 https://cve.radiocsirt.org/vuln/euvd-2026-334016 EUVD-2026-334016 2026-10-03T22:03:11.325566+00:00 EUVD-2026-334016 https://cve.radiocsirt.org/vuln/fkie_cve-2026-59890 fkie_cve-2026-59890 2026-10-03T22:03:11.325578+00:00

setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. Prior to 83.0.0, FileList applied MANIFEST.in exclude, global-exclude, recursive-exclude, and prune directives by matching compiled glob patterns against on-disk file names without Unicode normalization, so on macOS APFS or HFS+ an NFD file name could bypass an NFC exclusion rule and be packed into a source distribution. This issue is fixed in version 83.0.0.

 https://cve.radiocsirt.org/vuln/ghsa-h35f-9h28-mq5c GHSA-h35f-9h28-mq5c — setuptools: MANIFEST.in exclusion bypass in sdist via Unicode normalization collision (NFC/NFD) on macOS APFS/HFS+ 2026-10-03T22:03:11.325631+00:00

Affected: PyPI: setuptools

## Summary

When building a source distribution (`python -m build --sdist` / `setup.py sdist`), setuptools' `FileList` applies `MANIFEST.in` directives (`exclude`, `global-exclude`, `recursive-exclude`, `prune`) by matching a compiled glob against on-disk file names **byte-for-byte, with no Unicode normalization**. On normalization-preserving filesystems (notably macOS APFS and HFS+), a file written in NFD and a `MANIFEST.in` rule written in NFC refer to the same file but are byte-distinct, so the exclusion silently fails to match. A file the maintainer intended to exclude is then packed into the `.tar.gz` and, if published, uploaded to the public, immutable PyPI index.

## Details

File names in `FileList.files` come from `os.walk` (`setuptools/_distutils/filelist.py`, `_find_all_simple`), so on APFS a file written NFD is offered to the matcher in NFD, while the `MANIFEST.in` pattern carries the author's editor form (typically NFC). The matching path performs no canonicalization:

```python # setuptools/command/egg_info.py (FileList.global_exclude) def global_exclude(self, pattern): match = translate_pattern(os.path.join('**', pattern)) # fnmatch.translate -> regex, no NFC/NFD return self._remove_files(match.match) # byte-level regex over raw os.walk names ```

A rule written NFC (`café` = `63 61 66 c3 a9`) does not match an on-disk name written NFD (`café` = `63 61 66 65 cc 81`), even though the filesystem treats the two as one file.

A `unicod…

 https://cve.radiocsirt.org/vuln/msrc_cve-2026-59890 msrc_CVE-2026-59890 — setuptools: MANIFEST.in exclusion bypass in sdist via Unicode normalization collision (NFC/NFD) on macOS APFS/HFS+ 2026-10-03T22:03:11.325678+00:00 msrc_CVE-2026-59890 https://cve.radiocsirt.org/vuln/oesa-2026-3191 OESA-2026-3191 — python-setuptools security update 2026-10-03T22:03:11.325695+00:00

Affected: openEuler:24.03-LTS-SP4: python-setuptools, openEuler:20.03-LTS-SP4: python-setuptools, openEuler:22.03-LTS-SP4: python-setuptools, openEuler:24.03-LTS-SP1: python-setuptools, openEuler:24.03-LTS-SP3: python-setuptools

Setuptools is a collection of enhancements to the Python distutils that allow you to more easily build and distribute Python packages, especially ones that have dependencies on other packages. Security Fix(es):

setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. Prior to 83.0.0, FileList applied MANIFEST.in exclude, global-exclude, recursive-exclude, and prune directives by matching compiled glob patterns against on-disk file names without Unicode normalization, so on macOS APFS or HFS+ an NFD file name could bypass an NFC exclusion rule and be packed into a source distribution. This issue is fixed in version 83.0.0.(CVE-2026-59890)

 https://cve.radiocsirt.org/vuln/pysec-2026-3447 PYSEC-2026-3447 2026-10-03T22:03:11.325726+00:00

Affected: PyPI: setuptools

setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. Prior to 83.0.0, FileList applied MANIFEST.in exclude, global-exclude, recursive-exclude, and prune directives by matching compiled glob patterns against on-disk file names without Unicode normalization, so on macOS APFS or HFS+ an NFD file name could bypass an NFC exclusion rule and be packed into a source distribution. This issue is fixed in version 83.0.0.

 https://cve.radiocsirt.org/vuln/rhsa-2026:37530 RHSA-2026:37530 — Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update 2026-10-03T22:03:11.325746+00:00

setuptools: setuptools: MANIFEST.in exclusion bypass in sdist via Unicode normalization collision (NFC/NFD)

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-59890 UBUNTU-CVE-2026-59890 2026-10-03T22:03:11.325762+00:00

Affected: Ubuntu:20.04:LTS: setuptools, Ubuntu:22.04:LTS: setuptools, Ubuntu:24.04:LTS: setuptools, Ubuntu:25.10: setuptools, Ubuntu:26.04:LTS: setuptools

setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. Prior to 83.0.0, FileList applied MANIFEST.in exclude, global-exclude, recursive-exclude, and prune directives by matching compiled glob patterns against on-disk file names without Unicode normalization, so on macOS APFS or HFS+ an NFD file name could bypass an NFC exclusion rule and be packed into a source distribution. This issue is fixed in version 83.0.0.