{"id":"BIT-setuptools-2026-59890","summary":"setuptools: MANIFEST.in exclusion bypass in sdist via Unicode normalization collision (NFC/NFD) on macOS APFS/HFS+","details":"setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. Prior to 83.0.0, FileList applied MANIFEST.in exclude, global-exclude, recursive-exclude, and prune directives by matching compiled glob patterns against on-disk file names without Unicode normalization, so on macOS APFS or HFS+ an NFD file name could bypass an NFC exclusion rule and be packed into a source distribution. This issue is fixed in version 83.0.0.","aliases":["CVE-2026-59890","GHSA-h35f-9h28-mq5c","PYSEC-2026-3447"],"modified":"2026-09-08T08:48:19.342109152Z","published":"2026-07-14T08:55:22.983Z","database_specific":{"cpes":["cpe:2.3:a:python:setuptools:*:*:*:*:*:python:*:*"],"severity":"Medium"},"references":[{"type":"FIX","url":"https://github.com/pypa/setuptools/commit/dd9f436a36486b4cb8a4c70a2321548b0be09b8f"},{"type":"ARTICLE","url":"https://github.com/pypa/setuptools/releases/tag/v83.0.0"},{"type":"ADVISORY","url":"https://github.com/pypa/setuptools/security/advisories/GHSA-h35f-9h28-mq5c"},{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59890"}],"affected":[{"package":{"name":"setuptools","ecosystem":"Bitnami","purl":"pkg:bitnami/setuptools"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"83.0.0"}]}],"database_specific":{"source":"https://github.com/bitnami/vulndb/tree/main/data/setuptools/BIT-setuptools-2026-59890.json"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N"}]}],"schema_version":"1.9.0"}