HIGH8.8
PYSEC-2025-49
Quick fix
PYSEC-2025-49 — setuptools: upgrade to the fixed version with the command below.
pip install --upgrade 'setuptools>=250a6d17978f9f6ac3ac887091f2d32886fbbb0b'Details
setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. A path traversal vulnerability in `PackageIndex` is present in setuptools prior to version 78.1.1. An attacker would be allowed to write files to arbitrary locations on the filesystem with the permissions of the process running the Python code, which could escalate to remote code execution depending on the context. Version 78.1.1 fixes the issue.
Are you affected?
Enter the version of the package you're using.
Affected packages
PyPI/setuptools
Introduced in:
0Fixed in: 250a6d17978f9f6ac3ac887091f2d32886fbbb0bFix
pip install --upgrade 'setuptools>=250a6d17978f9f6ac3ac887091f2d32886fbbb0b'References
- https://github.com/pypa/setuptools/security/advisories/GHSA-5rjg-fvgr-3xxf[EVIDENCE]
- https://lists.debian.org/debian-lts-announce/2025/05/msg00035.html[ARTICLE]
- https://github.com/pypa/setuptools/issues/4946[REPORT]
- https://github.com/pypa/setuptools/commit/250a6d17978f9f6ac3ac887091f2d32886fbbb0b[FIX]
- https://github.com/pypa/setuptools/blob/6ead555c5fb29bc57fe6105b1bffc163f56fd558/setuptools/package_index.py#L810C1-L825C88[WEB]