{"id":"CVE-2026-59890","title":"setuptools: setuptools: MANIFEST.in exclusion bypass in sdist via Unicode normalization collision (NFC/NFD) (CVE-2026-59890)","summary":"A flaw was found in setuptools, a Python package management tool. The FileList component, responsible for handling file exclusions, did not properly normalize Unicode file names when applying exclusion rules. This oversight could allow a s…","severity":"medium","cvss":6.1,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N","cvssSource":"vendor","cwe":["CWE-1025","CWE-176","CWE-697"],"vendor":"Red Hat","product":"Red Hat Hardened Images","affected":["hardened_images"],"patched":["hardened_images"],"published":"2026-07-08","updated":"2026-10-15","sourceUpdated":"2026-10-15T11:20:31+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-59890.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-59890.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-59890"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2498155"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-59890"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59890"},{"url":"https://github.com/pypa/setuptools/commit/dd9f436a36486b4cb8a4c70a2321548b0be09b8f"},{"url":"https://github.com/pypa/setuptools/releases/tag/v83.0.0"},{"url":"https://github.com/pypa/setuptools/security/advisories/GHSA-h35f-9h28-mq5c"},{"url":"https://access.redhat.com/errata/RHSA-2026:37530"},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/setuptools/PYSEC-2026-3447.yaml"},{"url":"https://github.com/pypa/setuptools"},{"url":"https://github.com/advisories/GHSA-h35f-9h28-mq5c"}],"tags":["csaf","vex","red-hat","osv","pip","ghsa"],"epss":0.00405,"epssPercentile":0.34606,"aliases":["GHSA-h35f-9h28-mq5c","BIT-setuptools-2026-59890","PYSEC-2026-3447"],"ecosystem":"pip","ingestedAt":"2026-07-21T19:53:40.155Z","slug":"CVE-2026-59890","body":"## Overview\n\nA flaw was found in setuptools, a Python package management tool. The FileList component, responsible for handling file exclusions, did not properly normalize Unicode file names when applying exclusion rules. This oversight could allow a specially crafted file name, using a different Unicode normalization form (NFD) on macOS APFS or HFS+ file systems, to bypass an intended exclusion rule (NFC). As a result, sensitive files that should have been excluded could be inadvertently included in a source distribution, leading to information disclosure.\n\n## Vendor advisories\n\n- **RHSA-2026:37530** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-07-10 · [advisory](https://access.redhat.com/errata/RHSA-2026:37530)\n\n**setuptools: setuptools: MANIFEST.in exclusion bypass in sdist via Unicode normalization collision (NFC/NFD)** — rated Moderate by Red Hat. Released 2026-07-08, updated 2026-10-15.\n\nFixed:\n\n- Red Hat Hardened Images\n\nNot affected:\n\n- Exploit Intelligence\n- Lightspeed Core\n- Migration Toolkit for Applications 8\n- Migration Toolkit for Virtualization\n- Network Observability Operator\n- OpenShift Lightspeed\n- OpenShift Service Mesh 3\n- Red Hat AI Inference Server\n- Red Hat Ansible Automation Platform 2\n- Red Hat build of Quarkus Native builder\n\n## Remediation\n\nFor details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/ https://access.redhat.com/errata/RHSA-2026:37530\n\nWorkarounds / mitigations:\n\n- Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.\n\n## Package advisory (CVE-2026-59890)\n\nAffected packages:\n\n- `setuptools < 83.0.0`\n\nPatched in:\n\n- `setuptools 83.0.0`\n\nSource: https://osv.dev/vulnerability/GHSA-h35f-9h28-mq5c","depth":"sunlit","depthScore":34,"depthScoreParts":{"impact":33.6,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}