CVE-2026-59890: setuptools Unicode Normalization Bypass on macOS

Technical summary

The vulnerability stems from setuptools' FileList implementation, which processes MANIFEST.in directives (exclude, global-exclude, recursive-exclude, and prune) by matching glob patterns directly against filesystem filenames without performing Unicode normalization. On case-insensitive filesystems like macOS APFS and HFS+, two Unicode representations of the same character sequence can coexist: NFC (composed form, e.g., é as U+00E9) and NFD (decomposed form, e.g., e + ´ as U+0065 U+0301). When exclusion rules reference NFC-normalized filenames, an attacker can create files using NFD encoding that the glob matcher fails to recognize as matching, allowing those files to be included in the built source distribution. The fix in version 83.0.0 normalizes filenames during the matching process to ensure consistent comparison regardless of the Unicode representation on disk.

Business impact

For organizations consuming Python packages from public or private repositories, this vulnerability could allow unintended files—including source code, credentials, or malicious payloads—to be distributed within ostensibly vetted packages. Package maintainers who rely on MANIFEST.in exclusion rules to prevent sensitive artifacts from reaching end users may inadvertently ship packages containing excluded content. The attack surface is limited to macOS systems, but given the prevalence of macOS in development environments, the practical impact on supply chain integrity warrants attention. The medium CVSS score reflects the local attack vector (requires developer/packager involvement) and information disclosure as the primary concern, but the indirect reach through software supply chains elevates business risk.

Affected systems

Python setuptools versions prior to 83.0.0 are affected. The vulnerability manifests only on macOS systems running APFS or HFS+ filesystems, as these are the only common filesystems that preserve both NFC and NFD Unicode representations simultaneously. Linux and Windows systems are not affected because their filesystems normalize Unicode at the filesystem level or do not exhibit this behavior. Any development machine, CI/CD pipeline, or build server running an older setuptools version on macOS is a potential attack or misconfiguration point.

Exploitability

Exploitation requires local access or the ability to influence the package build process—typically a compromised developer account, a malicious contributor, or an insider threat. The attacker must intentionally create or modify files using NFD Unicode encoding to bypass exclusion rules. This is not a remote network vulnerability and does not affect end users installing pre-built wheels or binary distributions, only those building source distributions from setuptools-managed projects on affected macOS systems. Public exploitation likelihood is low because it requires deliberate Unicode manipulation, but determined attackers or supply chain adversaries would find this straightforward to weaponize. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog.

Remediation

Upgrade setuptools to version 83.0.0 or later. This version introduces Unicode normalization in the FileList glob matching logic, ensuring that both NFC and NFD representations of filenames are normalized to a consistent form before comparison against exclusion rules. Organizations should prioritize this update on macOS development machines and build infrastructure. Verify the update by confirming the setuptools version in your Python environment (pip show setuptools) and re-running any builds that may have been affected by the vulnerability window.

Patch guidance

Upgrade setuptools using 'pip install --upgrade setuptools>=83.0.0' or equivalent package management tools. Ensure all development machines, CI/CD agents, and build servers used by your organization are running the patched version. If you maintain Python packages, review your MANIFEST.in files to confirm they are using NFC-normalized filenames and test builds on macOS to ensure exclusion rules function as intended. For organizations with strict change control, validate the patch in a staging environment before full rollout, but given the medium severity and targeted nature of the fix, deployment can generally proceed promptly.

Detection guidance

Check setuptools version across your development environment: 'pip list | grep setuptools' or 'pip show setuptools'. Audit MANIFEST.in files in projects you maintain for any non-standard or internationalized filenames that could exist in NFD form. If you suspect files were unintentionally included in a source distribution, extract and inspect the source tarball (.tar.gz or .zip) and compare its contents against your MANIFEST.in rules. Review git history or file listings for any files with Unicode diacritics, particularly those that should have been excluded. Monitor package repositories for any unexpected file inclusions in recent distributions of your packages.

Why prioritize this

While the CVSS score of 6.1 (MEDIUM) reflects the local attack vector and limited information disclosure impact, several factors warrant prioritization: (1) the supply chain implications if exploited by maintainers or compromised developers, (2) the macOS-specific targeting, which is common in development environments, (3) the simplicity of the fix and low friction of upgrades, and (4) the absence of current active exploitation. For security teams managing Python development infrastructure or overseeing third-party Python package intake, this should be addressed within standard patching windows, with accelerated timelines if macOS is your primary development OS.

Risk score, explained

CVSS 3.1 score of 6.1 (MEDIUM) reflects: Attack Vector = Local (AV:L, requires local or build process access), Attack Complexity = Low (AC:L, no special preconditions), Privileges Required = None (PR:N), User Interaction = Required (UI:R, attacker must influence build or developer workflow), Scope = Unchanged (S:U), Confidentiality = High (C:H, sensitive files could be exposed), Integrity = Low (I:L, file inclusion rather than modification), Availability = None (A:N, no service disruption). The medium rating appropriately captures that this is a bounded threat requiring local/process influence, but with material information disclosure consequences in a supply chain context.

Frequently asked questions