WS-2026-0203
Published:October 23, 2026
Updated:November 13, 2026
setuptools 38.2.2 through 84.0.0: Wheel.install_as_egg() (setuptools/wheel.py, _fix_namespace_packages) joins each entry of a wheel's namespace_packages.txt into the destination path with os.path.join, so an absolute, drive-qualified or UNC entry escapes the egg directory and creates an __init__.py at a path chosen by the wheel. Reachable only through the deprecated setup_requires mechanism when setup() runs outside a PEP 517 frontend. Fixed in 84.1.0.
Affected Packages
setuptools (CONDA):
Affected version(s) >=63.1.0 <84.1.0 || >=69.0.3 <84.1.0 || >=41.0.0 <84.1.0 || >=66.0.0 <84.1.0 || >=82.0.0 <84.1.0 || >=51.0.0 <84.1.0 || >=57.4.0 <84.1.0 || =48.0.0 <84.1.0 || >=59.0.1 <84.1.0 || >=78.1.0 <84.1.0 || >=47.0.0 <84.1.0 || =73.0.1 <84.1.0 || >=45.0.0 <84.1.0 || >=42.0.0 <84.1.0 || >=70.0.0 <84.1.0 || >=50.0.0 <84.1.0 || =44.0.0 <84.1.0 || >=72.1.0 <84.1.0 || >=38.2.3 <84.1.0 || >=40.0.0 <84.1.0 || >=71.0.1 <84.1.0 || =74.1.2 <84.1.0 || >=58.0.0 <84.1.0 || >=68.0.0 <84.1.0 || >=39.0.0 <84.1.0 || >=49.1.0 <84.1.0 || =84.0.0 <84.1.0 || >=46.0.0 <84.1.0 || >=65.0.0 <84.1.0 || >=67.1.0 <84.1.0 || =83.0.0 <84.1.0 || >=62.0.0 <84.1.0 || >=64.0.0 <84.1.0 || =81.0.0 <84.1.0 || >=61.0.0 <84.1.0 || >=80.1.0 <84.1.0 || >=79.0.0 <84.1.0 || >=75.1.0 <84.1.0 || =52.0.0 <84.1.0 || >=60.0.3 <84.1.0Fix Suggestion:
Update to version 84.1.0https://github.com/pypa/setuptools.git (GITHUB):
Affected version(s) >=v38.2.2 <v84.1.0 || >=v39.0.0 <v84.1.0 || >=v40.0.0 <v84.1.0 || >=v41.0.0 <v84.1.0 || >=v42.0.0 <v84.1.0 || =v43.0.0 <v84.1.0 || >=v44.0.0 <v84.1.0 || >=v45.0.0 <v84.1.0 || >=v46.0.0 <v84.1.0 || >=v47.0.0 <v84.1.0 || =v48.0.0 <v84.1.0 || >=v49.0.0 <v84.1.0 || >=v50.0.0 <v84.1.0 || >=v51.0.0 <v84.1.0 || =v52.0.0 <v84.1.0 || >=v53.0.0 <v84.1.0 || >=v54.0.0 <v84.1.0 || =v55.0.0 <v84.1.0 || >=v56.0.0 <v84.1.0 || >=v57.0.0 <v84.1.0 || >=v58.0.0 <v84.1.0 || >=v59.0.0 <v84.1.0 || >=v60.0.0 <v84.1.0 || >=v61.0.0 <v84.1.0 || >=v62.0.0 <v84.1.0 || >=v63.0.0 <v84.1.0 || >=v64.0.0 <v84.1.0 || >=v65.0.0 <v84.1.0 || >=v66.0.0 <v84.1.0 || >=v67.0.0 <v84.1.0 || >=v68.0.0 <v84.1.0 || >=v69.0.0 <v84.1.0 || >=v70.0.0 <v84.1.0 || >=v71.0.0 <v84.1.0 || >=v72.0.0 <v84.1.0 || >=v73.0.0 <v84.1.0 || >=v74.0.0 <v84.1.0 || >=v75.0.0 <v84.1.0 || >=v76.0.0 <v84.1.0 || >=v77.0.0 <v84.1.0 || >=v78.0.0 <v84.1.0 || >=v79.0.0 <v84.1.0 || >=v80.0.0 <v84.1.0 || =v81.0.0 <v84.1.0 || >=v82.0.0 <v84.1.0 || =v83.0.0 <v84.1.0 || =v84.0.0 <v84.1.0 || =v63.0.0b1 <v84.1.0 || =v64.0.0b1 <v84.1.0 || =38.2.5 <v84.1.0Fix Suggestion:
Update to version v84.1.0setuptools (PYTHON):
Affected version(s) >=63.0.0 <84.1.0 || >=69.0.0 <84.1.0 || >=41.0.0 <84.1.0 || >=66.0.0 <84.1.0 || >=82.0.0 <84.1.0 || >=51.0.0 <84.1.0 || >=57.0.0 <84.1.0 || >=54.0.0 <84.1.0 || =48.0.0 <84.1.0 || >=59.0.1 <84.1.0 || >=78.0.1 <84.1.0 || >=47.0.0 <84.1.0 || >=73.0.0 <84.1.0 || =63.0.0b1 <84.1.0 || >=45.0.0 <84.1.0 || >=42.0.0 <84.1.0 || >=70.0.0 <84.1.0 || >=50.0.0 <84.1.0 || >=44.0.0 <84.1.0 || >=72.0.0 <84.1.0 || =43.0.0 <84.1.0 || >=38.2.3 <84.1.0 || >=40.0.0 <84.1.0 || >=71.0.0 <84.1.0 || >=74.0.0 <84.1.0 || >=58.0.0 <84.1.0 || >=68.0.0 <84.1.0 || >=39.0.0 <84.1.0 || >=49.0.0 <84.1.0 || =84.0.0 <84.1.0 || >=46.0.0 <84.1.0 || >=65.0.0 <84.1.0 || >=67.0.0 <84.1.0 || =83.0.0 <84.1.0 || >=62.0.0 <84.1.0 || >=56.0.0 <84.1.0 || >=64.0.0 <84.1.0 || =81.0.0 <84.1.0 || >=61.0.0 <84.1.0 || >=80.0.0 <84.1.0 || >=53.0.0 <84.1.0 || >=76.0.0 <84.1.0 || >=79.0.0 <84.1.0 || >=75.0.0 <84.1.0 || >=77.0.1 <84.1.0 || =52.0.0 <84.1.0 || >=60.0.0 <84.1.0Fix Suggestion:
Update to version 84.1.0Related Resources (5)
Do you need more information?
Contact UsCVSS v4
Base Score:
2
Attack Vector
LOCAL
Attack Complexity
HIGH
Attack Requirements
NONE
Privileges Required
NONE
User Interaction
PASSIVE
Vulnerable System Confidentiality
NONE
Vulnerable System Integrity
LOW
Vulnerable System Availability
NONE
Subsequent System Confidentiality
NONE
Subsequent System Integrity
NONE
Subsequent System Availability
NONE
CVSS v3
Base Score:
2.5
Attack Vector
LOCAL
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality
NONE
Integrity
LOW
Availability
NONE
Weakness Type (CWE)
Improper Limitation of a Pathname to a Restricted Directory