StackPrism

PyPI package

setuptools vulnerabilities by version

The latest release, 84.0.0 (Aug 8, 2026), has no known vulnerabilities. 8 of the 10 most recent releases have known vulnerabilities. OSV.dev lists 5 advisories for setuptools; the newest was published on Jul 21, 2026.

PyPI (opens in a new tab) describes it as “Most extensible Python build backend with support for C/C++ extension modules”

Latest release
84.0.0
Aug 8, 2026, no known vulnerabilities
Downloads last week
231.2M
All versions, from pypistats.org
Advisories on OSV.dev
5
Newest Jul 21, 2026
Licence
MIT
OpenSSF Scorecard
4.4/10
pypa/setuptools (opens in a new tab)

Recent releases

PyPI doesn’t publish downloads per version, so these are the newest releases, each checked against OSV.dev. Open a version for its advisories and what to upgrade to.

VersionKnown vulnerabilities
84.0.0latestAug 8, 2026No known vulnerabilities
83.0.0Jul 4, 2026No known vulnerabilities
82.0.1Mar 9, 20261 known vulnerability, worst rated warning
82.0.0Feb 8, 20261 known vulnerability, worst rated warning
75.3.4Feb 8, 20262 known vulnerabilities, worst rated critical
81.0.0Feb 6, 20261 known vulnerability, worst rated warning
80.10.2Jan 25, 20261 known vulnerability, worst rated warning
80.10.1Jan 21, 20261 known vulnerability, worst rated warning
75.3.3Jan 14, 20262 known vulnerabilities, worst rated critical
80.9.0May 27, 20251 known vulnerability, worst rated warning

Release lines

The newest release of each minor line, from the registry. setuptools doesn’t publish support dates we can check.

LineNewest releaseReleased
84.084.0.0Aug 8, 2026
83.083.0.0Jul 4, 2026
82.082.0.1Mar 9, 2026
81.081.0.0Feb 6, 2026
80.1080.10.2Jan 25, 2026
80.980.9.0May 27, 2025

Newest advisories

The 5 most recently published, with the versions each one affects.

  1. WarningCVE-2026-59890 on OSV.dev (opens in a new tab)GHSA-h35f-9h28-mq5c

    setuptools: MANIFEST.in exclusion bypass in sdist via Unicode normalization collision (NFC/NFD) on macOS APFS/HFS+

    Affects < 83.0.0. Published Jul 21, 2026.

  2. CriticalCVE-2025-47273 on OSV.dev (opens in a new tab)GHSA-5rjg-fvgr-3xxf

    setuptools has a path traversal vulnerability in PackageIndex.download that leads to Arbitrary File Write

    Affects < 78.1.1. Published May 19, 2025.

  3. CriticalCVE-2024-6345 on OSV.dev (opens in a new tab)GHSA-cx63-2mw6-8hw5

    setuptools vulnerable to Command Injection via package URL

    Affects < 70.0.0. Published Jul 15, 2024.

  4. CriticalCVE-2022-40897 on OSV.dev (opens in a new tab)GHSA-r9hx-vwmv-q579

    pypa/setuptools vulnerable to Regular Expression Denial of Service (ReDoS)

    Affects < 65.5.1. Published Dec 23, 2022.

  5. CriticalCVE-2013-1633 on OSV.dev (opens in a new tab)GHSA-27x4-j476-jp5f

    Setuptools vulnerable to Man-in-the-middle attacks

    Affects < 0.7. Published May 17, 2022.

Which setuptools do you have?

Paste a public GitHub repo or drop your requirements.txt or pyproject.toml and see every vulnerable, end-of-life or deprecated dependency, with one fix task for your coding agent. Free, no sign-up.

Check your whole repo

How this page is checked

StackPrism reads every OSV.dev advisory for setuptools, merges duplicates filed under several ids, and asks OSV.dev which ones affect each version listed. Releases and their dates come from deps.dev, downloads from pypistats.org. No AI writes this page: every sentence comes from that data, refreshed every few hours.

Last checked against OSV.dev, CISA KEV, PyPI, pypistats.org and deps.dev.