setuptools — CVE history (PyPI)
setuptools
4 CVEs affect the setuptools PyPI package (highest CVSS 8.8). Latest disclosed: 2026-07-08. Full CVE history sourced from NVD.
Summary
- Package
setuptools(PyPI)- Total CVEs
4- Actively exploited (CISA KEV)
- 0
- Highest CVSS
8.8- Latest disclosed
- 2026-07-08
Recent CVEs (top 4)
| CVE | Severity | CVSS | KEV | Published | Summary |
|---|---|---|---|---|---|
CVE-2026-59890 | Medium | 6.1 | — | 2026-07-08 | setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. |
CVE-2025-47273 | High | 8.8 | — | 2025-05-17 | setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. |
CVE-2022-40897 | Medium | 5.9 | — | 2022-12-23 | Python Packaging Authority (PyPA) setuptools before 65.5.1 allows remote attackers to cause a denial of service via HTML in a crafted package or custom PackageIndex page. |
CVE-2013-1633 | — | — | — | 2013-08-06 | easy_install in setuptools before 0.7 uses HTTP to retrieve packages from the PyPI repository, and does not perform integrity checks on package contents, which allows man-in-the-middle attackers to execute arbitrary code via a crafted resp… |
All-time worst (top 3 by CVSS)
| CVE | Severity | CVSS | KEV | Published | Summary |
|---|---|---|---|---|---|
CVE-2025-47273 | High | 8.8 | — | 2025-05-17 | setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. |
CVE-2026-59890 | Medium | 6.1 | — | 2026-07-08 | setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. |
CVE-2022-40897 | Medium | 5.9 | — | 2022-12-23 | Python Packaging Authority (PyPA) setuptools before 65.5.1 allows remote attackers to cause a denial of service via HTML in a crafted package or custom PackageIndex page. |