CVE-2026-59890: Setuptools MANIFEST.in Exclusion Bypass via Unicode Normalization Collision
Summary
CVE-2026-59890: setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. Affects setuptools versions < 83.0.0. Fixed in 83.0.0. How to fix ↓
Also tracked for
- setuptools · PyPI
- setuptools · PyPI
The same CVE-2026-59890 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Setuptools is a widely used Python package that facilitates the downloading, building, installation, upgrading, and uninstallation of Python packages. It is integral to Python development, allowing developers to manage dependencies and package distributions efficiently. However, prior to version 83.0.0, Setuptools had a vulnerability that could lead to unintended file inclusions in source distributions due to how it handled file name normalization on macOS file systems.
Vulnerability Detail
The vulnerability arises from the way Setuptools applied exclusion rules defined in MANIFEST.in. Specifically, it did not normalize Unicode file names when matching against exclusion patterns. This oversight allowed files with names in Normalization Form D (NFD) to bypass exclusion rules defined in Normalization Form C (NFC). As a result, malicious or unintended files could be included in source distributions, potentially leading to security risks such as code execution or data exposure.
How To Fix
Minimum fixed version
83.0.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, users can manually check their MANIFEST.in files and ensure that no NFD file names are present that could bypass NFC exclusions. However, the best course of action is to update to the patched version.
Conclusion
The vulnerability identified as CVE-2026-59890 in Setuptools poses a significant risk due to its potential to allow unintended file inclusions in source distributions. Users are strongly encouraged to update to version 83.0.0 or later to mitigate this risk effectively.
See every vulnerability recorded for setuptools →
FAQ
The vulnerability can lead to unintended files being included in source distributions, which may pose security risks such as code execution or data exposure.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. By using the Vulert playground, you can check if your application is affected without any signup.
Versions of Setuptools prior to 83.0.0 are affected by this vulnerability.
While updating is the best solution, you can manually review your MANIFEST.in files to ensure no NFD file names are present that could bypass NFC exclusions.
More information can be found in the vulnerability database or on the official GitHub repository for Setuptools.
References
Related vulnerabilities
Recent vulnerabilities recorded for setuptools.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
