CVE-2026-59890

Name of the Vulnerable Software and Affected Versions setuptools versions prior to 83.0.0

Description setuptools is a package used to download, build, install, upgrade, and uninstall Python packages. The FileList component fails to perform Unicode normalization when matching compiled glob patterns against on-disk file names for MANIFEST.in exclude, global-exclude, recursive-exclude, and prune directives. On macOS APFS or HFS+ file systems, a file name using NFD (Normalization Form Decomposed) can bypass an NFC (Normalization Form Composed) exclusion rule, resulting in the file being unintentionally included in a source distribution.

Recommendations Update setuptools to version 83.0.0.