---
schema_version: '1.0'
id: security-20260715-584ebf
url: https://osv.dev/vulnerability/PYSEC-2026-3447
url_hash: 584ebfe54c209d44154012a2a552bb0494e2988accb544cbf92830b2a6097773
canonical_url: https://osv.dev/vulnerability/PYSEC-2026-3447
source: osv:pypa
category: security/library
category_raw: cve/library
region: null
tags:
- cve
- CVE-2026-59890
- PYSEC-2026-3447
- severity:CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N
- setuptools
- PyPI
lang: en
published_at: '2026-07-08T17:17:27Z'
fetched_at: '2026-07-15T06:44:14Z'
updated_at: '2026-07-15T06:44:36Z'
status: published
content_hash: cfdd5e8f8c776a3484fbff8a9152212a106799b3cdbdf631cd9d5bcf29d30566
license_note: full
summary: setuptools is a package that allows users to download, build, install, upgrade,
  and uninstall Python packages. Prior to 83.0.0, FileList applied MANIFEST.in exclude,
  global-exclude, recursive-exclude, and prune directives by matching compiled glob
  patterns against on-disk file na
summary_source: rss
summary_en: setuptools is a package that allows users to download, build, install,
  upgrade, and uninstall Python packages. Prior to 83.0.0, FileList applied MANIFEST.in
  exclude, global-exclude, recursive-exclude, and prune directives by matching compiled
  glob patterns against on-disk file na
entities:
- name: PyPI
  type: UNKNOWN
key_facts: []
related: []
related_auto:
- name: agent_n8n_1_bot
  type: organization
  weight: 1.0
title: CVE-2026-59890 — setuptools
---

# CVE-2026-59890 — setuptools

## TL;DR
setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. Prior to 83.0.0, FileList applied MANIFEST.in exclude, global-exclude, recursive-exclude, and prune directives by matching compiled glob patterns against on-disk file na

## Key Points
- cve / CVE-2026-59890 / PYSEC-2026-3447 / severity:CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N / setuptools / PyPI

## Details
**Severity:** CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N
**Advisory:** PYSEC-2026-3447 (CVE-2026-59890)

**Affected (your watchlist):**
- `PyPI:setuptools` 79.0.1 → fixed in 83.0.0 [docker/docker-llmwiki+docker/docker-portal+docker/local+docker/mac]
- `PyPI:setuptools` 80.9.0 → fixed in 83.0.0 [docker/docker-mcp]

**Details:**
setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. Prior to 83.0.0, FileList applied MANIFEST.in exclude, global-exclude, recursive-exclude, and prune directives by matching compiled glob patterns against on-disk file names without Unicode normalization, so on macOS APFS or HFS+ an NFD file name could bypass an NFC exclusion rule and be packed into a source distribution. This issue is fixed in version 83.0.0.

**References:**
- https://github.com/pypa/setuptools/releases/tag/v83.0.0
- https://github.com/pypa/setuptools/commit/dd9f436a36486b4cb8a4c70a2321548b0be09b8f
- https://github.com/pypa/setuptools/security/advisories/GHSA-h35f-9h28-mq5c

_Data: OSV.dev (upstream: pypa) — https://osv.dev/vulnerability/PYSEC-2026-3447_

## Source
元記事: [CVE-2026-59890 — setuptools](https://osv.dev/vulnerability/PYSEC-2026-3447) — published 2026-07-08T17:17:27Z