https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 21:11:57 +0000 https://cve.radiocsirt.org/vuln/bell-cve-2026-59890 <p><strong>Affected:</strong> Alpaquita:stream: py3-setuptools, BellSoft Hardened Containers:stream: py3-setuptools</p> <p><strong>Affected:</strong> Alpaquita:stream: py3-setuptools, BellSoft Hardened Containers:stream: py3-setuptools</p> https://cve.radiocsirt.org/vuln/bell-cve-2026-59890 https://cve.radiocsirt.org/vuln/bit-setuptools-2026-59890 <p><strong>Affected:</strong> Bitnami: setuptools</p> <p>setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. Prior to 83.0.0, FileList applied MANIFEST.in exclude, global-exclude, recursive-exclude, and prune directives by matching compiled glob patterns against on-disk file names without Unicode normalization, so on macOS APFS or HFS+ an NFD file name could bypass an NFC exclusion rule and be packed into a source distribution. This issue is fixed in version 83.0.0.</p> <p><strong>Affected:</strong> Bitnami: setuptools</p> <p>setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. Prior to 83.0.0, FileList applied MANIFEST.in exclude, global-exclude, recursive-exclude, and prune directives by matching compiled glob patterns against on-disk file names without Unicode normalization, so on macOS APFS or HFS+ an NFD file name could bypass an NFC exclusion rule and be packed into a source distribution. This issue is fixed in version 83.0.0.</p> https://cve.radiocsirt.org/vuln/bit-setuptools-2026-59890 https://cve.radiocsirt.org/vuln/brew-ansible-builder-cve-2026-59890 <p><strong>Affected:</strong> Homebrew: ansible-builder</p> <p>## Summary</p> <p>When building a source distribution (`python -m build --sdist` / `setup.py sdist`), setuptools&#39; `FileList` applies `MANIFEST.in` directives (`exclude`, `global-exclude`, `recursive-exclude`, `prune`) by matching a compiled glob against on-disk file names **byte-for-byte, with no Unicode normalization**. On normalization-preserving filesystems (notably macOS APFS and HFS+), a file written in NFD and a `MANIFEST.in` rule written in NFC refer to the same file but are byte-distinct, so the exclusion silently fails to match. A file the maintainer intended to exclude is then packed into the `.tar.gz` and, if published, uploaded to the public, immutable PyPI index.</p> <p>## Details</p> <p>File names in `FileList.files` come from `os.walk` (`setuptools/_distutils/filelist.py`, `_find_all_simple`), so on APFS a file written NFD is offered to the matcher in NFD, while the `MANIFEST.in` pattern carries the author&#39;s editor form (typically NFC). The matching path performs no canonicalization:</p> <p>```python # setuptools/command/egg_info.py (FileList.global_exclude) def global_exclude(self, pattern): match = translate_pattern(os.path.join(&#39;**&#39;, pattern)) # fnmatch.translate -&gt; regex, no NFC/NFD return self._remove_files(match.match) # byte-level regex over raw os.walk names ```</p> <p>A rule written NFC (`café` = `63 61 66 c3 a9`) does not match an on-disk name written NFD (`café` = `63 61 66 65 cc 81`), even though the filesystem treats the two as one file.</p> <p>A `unicod…</p> <p><strong>Affected:</strong> Homebrew: ansible-builder</p> <p>## Summary</p> <p>When building a source distribution (`python -m build --sdist` / `setup.py sdist`), setuptools&#39; `FileList` applies `MANIFEST.in` directives (`exclude`, `global-exclude`, `recursive-exclude`, `prune`) by matching a compiled glob against on-disk file names **byte-for-byte, with no Unicode normalization**. On normalization-preserving filesystems (notably macOS APFS and HFS+), a file written in NFD and a `MANIFEST.in` rule written in NFC refer to the same file but are byte-distinct, so the exclusion silently fails to match. A file the maintainer intended to exclude is then packed into the `.tar.gz` and, if published, uploaded to the public, immutable PyPI index.</p> <p>## Details</p> <p>File names in `FileList.files` come from `os.walk` (`setuptools/_distutils/filelist.py`, `_find_all_simple`), so on APFS a file written NFD is offered to the matcher in NFD, while the `MANIFEST.in` pattern carries the author&#39;s editor form (typically NFC). The matching path performs no canonicalization:</p> <p>```python # setuptools/command/egg_info.py (FileList.global_exclude) def global_exclude(self, pattern): match = translate_pattern(os.path.join(&#39;**&#39;, pattern)) # fnmatch.translate -&gt; regex, no NFC/NFD return self._remove_files(match.match) # byte-level regex over raw os.walk names ```</p> <p>A rule written NFC (`café` = `63 61 66 c3 a9`) does not match an on-disk name written NFD (`café` = `63 61 66 65 cc 81`), even though the filesystem treats the two as one file.</p> <p>A `unicod…</p> https://cve.radiocsirt.org/vuln/brew-ansible-builder-cve-2026-59890 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0873 certfr-2026-avi-0873 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0873 https://cve.radiocsirt.org/vuln/cleanstart-2026-bc02149 <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: airflow-3</p> <p>Package airflow-3 version 3.1.8-r6 fixes 13 vulnerabilities: CVE-2026-53533, CVE-2026-59885, CVE-2026-59886, CVE-2026-59890, CVE-2026-49476...</p> <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: airflow-3</p> <p>Package airflow-3 version 3.1.8-r6 fixes 13 vulnerabilities: CVE-2026-53533, CVE-2026-59885, CVE-2026-59886, CVE-2026-59890, CVE-2026-49476...</p> https://cve.radiocsirt.org/vuln/cleanstart-2026-bc02149 https://cve.radiocsirt.org/vuln/euvd-2026-334016 EUVD-2026-334016 https://cve.radiocsirt.org/vuln/euvd-2026-334016 https://cve.radiocsirt.org/vuln/fkie_cve-2026-59890 <p>setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. Prior to 83.0.0, FileList applied MANIFEST.in exclude, global-exclude, recursive-exclude, and prune directives by matching compiled glob patterns against on-disk file names without Unicode normalization, so on macOS APFS or HFS+ an NFD file name could bypass an NFC exclusion rule and be packed into a source distribution. This issue is fixed in version 83.0.0.</p> <p>setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. Prior to 83.0.0, FileList applied MANIFEST.in exclude, global-exclude, recursive-exclude, and prune directives by matching compiled glob patterns against on-disk file names without Unicode normalization, so on macOS APFS or HFS+ an NFD file name could bypass an NFC exclusion rule and be packed into a source distribution. This issue is fixed in version 83.0.0.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-59890 https://cve.radiocsirt.org/vuln/ghsa-h35f-9h28-mq5c <p><strong>Affected:</strong> PyPI: setuptools</p> <p>## Summary</p> <p>When building a source distribution (`python -m build --sdist` / `setup.py sdist`), setuptools&#39; `FileList` applies `MANIFEST.in` directives (`exclude`, `global-exclude`, `recursive-exclude`, `prune`) by matching a compiled glob against on-disk file names **byte-for-byte, with no Unicode normalization**. On normalization-preserving filesystems (notably macOS APFS and HFS+), a file written in NFD and a `MANIFEST.in` rule written in NFC refer to the same file but are byte-distinct, so the exclusion silently fails to match. A file the maintainer intended to exclude is then packed into the `.tar.gz` and, if published, uploaded to the public, immutable PyPI index.</p> <p>## Details</p> <p>File names in `FileList.files` come from `os.walk` (`setuptools/_distutils/filelist.py`, `_find_all_simple`), so on APFS a file written NFD is offered to the matcher in NFD, while the `MANIFEST.in` pattern carries the author&#39;s editor form (typically NFC). The matching path performs no canonicalization:</p> <p>```python # setuptools/command/egg_info.py (FileList.global_exclude) def global_exclude(self, pattern): match = translate_pattern(os.path.join(&#39;**&#39;, pattern)) # fnmatch.translate -&gt; regex, no NFC/NFD return self._remove_files(match.match) # byte-level regex over raw os.walk names ```</p> <p>A rule written NFC (`café` = `63 61 66 c3 a9`) does not match an on-disk name written NFD (`café` = `63 61 66 65 cc 81`), even though the filesystem treats the two as one file.</p> <p>A `unicod…</p> <p><strong>Affected:</strong> PyPI: setuptools</p> <p>## Summary</p> <p>When building a source distribution (`python -m build --sdist` / `setup.py sdist`), setuptools&#39; `FileList` applies `MANIFEST.in` directives (`exclude`, `global-exclude`, `recursive-exclude`, `prune`) by matching a compiled glob against on-disk file names **byte-for-byte, with no Unicode normalization**. On normalization-preserving filesystems (notably macOS APFS and HFS+), a file written in NFD and a `MANIFEST.in` rule written in NFC refer to the same file but are byte-distinct, so the exclusion silently fails to match. A file the maintainer intended to exclude is then packed into the `.tar.gz` and, if published, uploaded to the public, immutable PyPI index.</p> <p>## Details</p> <p>File names in `FileList.files` come from `os.walk` (`setuptools/_distutils/filelist.py`, `_find_all_simple`), so on APFS a file written NFD is offered to the matcher in NFD, while the `MANIFEST.in` pattern carries the author&#39;s editor form (typically NFC). The matching path performs no canonicalization:</p> <p>```python # setuptools/command/egg_info.py (FileList.global_exclude) def global_exclude(self, pattern): match = translate_pattern(os.path.join(&#39;**&#39;, pattern)) # fnmatch.translate -&gt; regex, no NFC/NFD return self._remove_files(match.match) # byte-level regex over raw os.walk names ```</p> <p>A rule written NFC (`café` = `63 61 66 c3 a9`) does not match an on-disk name written NFD (`café` = `63 61 66 65 cc 81`), even though the filesystem treats the two as one file.</p> <p>A `unicod…</p> https://cve.radiocsirt.org/vuln/ghsa-h35f-9h28-mq5c https://cve.radiocsirt.org/vuln/msrc_cve-2026-59890 msrc_CVE-2026-59890 https://cve.radiocsirt.org/vuln/msrc_cve-2026-59890 https://cve.radiocsirt.org/vuln/oesa-2026-3191 <p><strong>Affected:</strong> openEuler:24.03-LTS-SP4: python-setuptools, openEuler:20.03-LTS-SP4: python-setuptools, openEuler:22.03-LTS-SP4: python-setuptools, openEuler:24.03-LTS-SP1: python-setuptools, openEuler:24.03-LTS-SP3: python-setuptools</p> <p>Setuptools is a collection of enhancements to the Python distutils that allow you to more easily build and distribute Python packages, especially ones that have dependencies on other packages. Security Fix(es):</p> <p>setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. Prior to 83.0.0, FileList applied MANIFEST.in exclude, global-exclude, recursive-exclude, and prune directives by matching compiled glob patterns against on-disk file names without Unicode normalization, so on macOS APFS or HFS+ an NFD file name could bypass an NFC exclusion rule and be packed into a source distribution. This issue is fixed in version 83.0.0.(CVE-2026-59890)</p> <p><strong>Affected:</strong> openEuler:24.03-LTS-SP4: python-setuptools, openEuler:20.03-LTS-SP4: python-setuptools, openEuler:22.03-LTS-SP4: python-setuptools, openEuler:24.03-LTS-SP1: python-setuptools, openEuler:24.03-LTS-SP3: python-setuptools</p> <p>Setuptools is a collection of enhancements to the Python distutils that allow you to more easily build and distribute Python packages, especially ones that have dependencies on other packages. Security Fix(es):</p> <p>setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. Prior to 83.0.0, FileList applied MANIFEST.in exclude, global-exclude, recursive-exclude, and prune directives by matching compiled glob patterns against on-disk file names without Unicode normalization, so on macOS APFS or HFS+ an NFD file name could bypass an NFC exclusion rule and be packed into a source distribution. This issue is fixed in version 83.0.0.(CVE-2026-59890)</p> https://cve.radiocsirt.org/vuln/oesa-2026-3191 https://cve.radiocsirt.org/vuln/pysec-2026-3447 <p><strong>Affected:</strong> PyPI: setuptools</p> <p>setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. Prior to 83.0.0, FileList applied MANIFEST.in exclude, global-exclude, recursive-exclude, and prune directives by matching compiled glob patterns against on-disk file names without Unicode normalization, so on macOS APFS or HFS+ an NFD file name could bypass an NFC exclusion rule and be packed into a source distribution. This issue is fixed in version 83.0.0.</p> <p><strong>Affected:</strong> PyPI: setuptools</p> <p>setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. Prior to 83.0.0, FileList applied MANIFEST.in exclude, global-exclude, recursive-exclude, and prune directives by matching compiled glob patterns against on-disk file names without Unicode normalization, so on macOS APFS or HFS+ an NFD file name could bypass an NFC exclusion rule and be packed into a source distribution. This issue is fixed in version 83.0.0.</p> https://cve.radiocsirt.org/vuln/pysec-2026-3447 https://cve.radiocsirt.org/vuln/rhsa-2026:37530 <p>setuptools: setuptools: MANIFEST.in exclusion bypass in sdist via Unicode normalization collision (NFC/NFD)</p> <p>setuptools: setuptools: MANIFEST.in exclusion bypass in sdist via Unicode normalization collision (NFC/NFD)</p> https://cve.radiocsirt.org/vuln/rhsa-2026:37530 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-59890 <p><strong>Affected:</strong> Ubuntu:20.04:LTS: setuptools, Ubuntu:22.04:LTS: setuptools, Ubuntu:24.04:LTS: setuptools, Ubuntu:25.10: setuptools, Ubuntu:26.04:LTS: setuptools</p> <p>setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. Prior to 83.0.0, FileList applied MANIFEST.in exclude, global-exclude, recursive-exclude, and prune directives by matching compiled glob patterns against on-disk file names without Unicode normalization, so on macOS APFS or HFS+ an NFD file name could bypass an NFC exclusion rule and be packed into a source distribution. This issue is fixed in version 83.0.0.</p> <p><strong>Affected:</strong> Ubuntu:20.04:LTS: setuptools, Ubuntu:22.04:LTS: setuptools, Ubuntu:24.04:LTS: setuptools, Ubuntu:25.10: setuptools, Ubuntu:26.04:LTS: setuptools</p> <p>setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. Prior to 83.0.0, FileList applied MANIFEST.in exclude, global-exclude, recursive-exclude, and prune directives by matching compiled glob patterns against on-disk file names without Unicode normalization, so on macOS APFS or HFS+ an NFD file name could bypass an NFC exclusion rule and be packed into a source distribution. This issue is fixed in version 83.0.0.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-59890