CVE-2026-59890: setuptools — Exploit & Fix

Description

setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. Prior to 83.0.0, FileList applied MANIFEST.in exclude, global-exclude, recursive-exclude, and prune directives by matching compiled glob patterns against on-disk file names without Unicode normalization, so on macOS APFS or HFS+ an NFD file name could bypass an NFC exclusion rule and be packed into a source distribution. This issue is fixed in version 83.0.0.

Is your site exposed to CVE-2026-59890?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

6.1

MEDIUM

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N

EPSS — Exploit Prediction

0.0029

Probability of exploitation

0.21%

Percentile rank

EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.

Weakness Type (CWE)

CWE-176 CWE-176

CWE-697 CWE-697

Affected Products

Vendor	Product	Versions
python	setuptools	< 83.0.0

References

Advisories & Patches

https://github.com/pypa/setuptools/commit/dd9f436a36486b4cb8a4c70a2321548b0be09b8f https://github.com/pypa/setuptools/security/advisories/GHSA-h35f-9h28-mq5c https://github.com/pypa/setuptools/security/advisories/GHSA-h35f-9h28-mq5c

Exploits

https://github.com/pypa/setuptools/security/advisories/GHSA-h35f-9h28-mq5c https://github.com/pypa/setuptools/security/advisories/GHSA-h35f-9h28-mq5c

Other References

https://github.com/pypa/setuptools/releases/tag/v83.0.0

Frequently Asked Questions

What is CVE-2026-59890? +

setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. Prior to 83.0.0, FileList applied MANIFEST.in exclude, global-exclude, recursive-exclude, and prune directives by matching compiled glob patterns against on-disk file names without Unicode normalization, so on macOS APFS or HFS+ an NFD file name could bypass an NFC exclusion rule and be packed into a source distribution. This issue is fixed in version 83.0.0. It has a CVSS v3.1 base score of 6.1 (MEDIUM).

How severe is CVE-2026-59890? +

CVE-2026-59890 has a CVSS v3.1 score of 6.1 out of 10, rated MEDIUM. This is a medium-severity vulnerability that should be remediated as part of regular maintenance. The EPSS score is 0.0029, placing it in the 0th percentile for exploitation probability.

What products are affected by CVE-2026-59890? +

CVE-2026-59890 affects products from python, specifically: setuptools. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2026-59890? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2017-20190

Some Microsoft technologies as used in Windows 8 through 11 allow a temporary client-side performance degradation during processing of multiple …

CVE-2024-8067

In versions of Helix Core prior to 2024.1 Patch 2 (2024.1/2655224) a Windows ANSI API Unicode "best fit" argument injection …

CVE-2024-47611

XZ Utils provide a general-purpose data-compression library plus command-line tools. When built for native Windows (MinGW-w64 or MSVC), the command …

CVE-2025-71316 9.8

SQLite 'sqldiff.exe' does not securely handle the way the Microsoft Windows C runtime converts Unicode characters to ANSI codepages. An …

CVE-2024-24691 9.6

Improper input validation in Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom Meeting SDK for Windows …

CVE-2026-45062 8.1

FrankenPHP is a modern application server for PHP. From version 1.11.2 to before version 1.12.3, the splitPos() function in cgi.go …

CVE-2026-59890