setuptools CVE-2026-59890

Exploitation requires all of the following conditions simultaneously: (1) the build machine must be macOS with an APFS or HFS+ filesystem, where filenames can be stored in NFD Unicode form; (2) at least one file in the project directory must have an NFD-normalized on-disk filename, which typically occurs when filenames contain accented characters such as é, ñ, ü, or other composed Unicode glyphs; (3) a MANIFEST.in file must contain an exclude, global-exclude, recursive-exclude, or prune directive targeting that file, written in NFC encoding; (4) the developer must actively run a setuptools-based sdist build (UI:R per CVSS). The vulnerability does not affect builds on Linux or Windows, projects with ASCII-only filenames, or projects that do not use MANIFEST.in exclusion directives. These combined prerequisites substantially reduce the realistic affected population to macOS-based Python maintainers publishing packages with non-ASCII filenames under active exclusion rules.

The vendor CVSS 6.1 Medium vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N accurately places the attack vector as local and requires user interaction (running the build command), reflecting that this is not a network-exploitable flaw. However, the AC:L designation is contestable - successful exploitation requires the concurrent presence of at least three platform-specific conditions: macOS with APFS or HFS+, one or more files with NFD-normalized filenames, and a MANIFEST.in containing an active exclusion rule written in NFC. An independent assessment places this at AC:H. The C:H score is the most significant signal: if sensitive files escape into published packages, the downstream confidentiality impact can be severe and irreversible. This vulnerability is not in the CISA KEV catalog, no EPSS data was available in the provided intelligence, and no public proof-of-concept code has been identified. The 'Authentication Bypass' tag in source metadata appears to be an automated misclassification - this is a glob exclusion bypass via normalization mismatch, not an authentication control bypass. Real-world priority is highest for macOS-based Python maintainers who publish packages to public registries and use MANIFEST.in exclusion directives; the vulnerability has no relevance in Linux CI environments or ASCII-only projects.

A Python developer on macOS with APFS creates a project that includes a file such as config_café.env whose filename is stored in NFD form by the filesystem after being created via Finder or certain shell operations. The developer adds exclude config_café.env to MANIFEST.in using NFC encoding as produced by their text editor, intending to prevent publication of the file. When python -m build is run, the NFD on-disk name silently fails to match the NFC glob pattern; setuptools includes the file in the generated sdist tarball without any warning. The developer publishes the package to PyPI, inadvertently exposing API keys or database credentials to anyone who downloads the source distribution - no exploit code or attacker interaction is required beyond downloading the published tarball.