Executive brief
setuptools vulnerable to Command Injection via package URL
Affected products
- PyPI setuptools
Junglewise Threat Intelligence
CVE-2024-6345: PYSEC-2026-1918 - setuptools vulnerable to Command Injection via package URL
CVE-2024-6345 · Severity: low · CVSS 3.1 · Published 2026-07-07
Technologies: setuptools (PyPI). Vendors: PyPI.
Related threats
- pypa setuptools Unicode normalization bypass in MANIFEST.in exclusions
- PYSEC-2025-49 - setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. A path traversal vulnerabilit
- PYSEC-2022-43012 - Python Packaging Authority (PyPA) setuptools before 65.5.1 allows remote attackers to cause a denial of service via HTML in a crafted packag
- PYSEC-2013-22 - easy_install in setuptools before 0.7 uses HTTP to retrieve packages from the PyPI repository, and does not perform integrity checks on pack