To report a security vulnerability, please file a security advisory in GitHub. For help or for questions, escalate through the Tidelift security contact.
Repository navigation
Security: pypa/setuptools
Security
SECURITY.md
-
Windows path escape via namespace_packages.txt during legacy wheel installation DescriptionGHSA-xmj3-9gf7-h52w published
Oct 19, 2026 by jaracoLow -
MANIFEST.in exclusion bypass in sdist via Unicode normalization collision (NFC/NFD) on macOS APFS/HFS+GHSA-h35f-9h28-mq5c published
Jul 4, 2026 by jaracoModerate -
Path traversal in PackageIndex.download leads to Arbitrary File WriteGHSA-5rjg-fvgr-3xxf published
May 17, 2025 by jaracoModerate
Learn more about advisories related to pypa/setuptools in the GitHub Advisory Database