PyPI/setuptools CVE-2024-6345: high 8.8, EPSS 1.94%
setuptools vulnerable to Command Injection via package URL
Action: Upgrade setuptools to 70.0.0 or later.
pip install setuptools==70.0.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 70.0.0 | - |
Fixed versions
| 70.0.0 |
Sources
- osv: PYSEC-2026-1918
- https://nvd.nist.gov/vuln/detail/CVE-2024-6345
- https://github.com/pypa/setuptools/pull/4332
- https://github.com/pypa/setuptools/commit/88807c7062788254f654ea8c03427adc859321f0
- https://github.com/pypa/setuptools
- https://huntr.com/bounties/d6362117-ad57-4e83-951f-b8141c6e7ca5
- https://lists.debian.org/debian-lts-announce/2024/09/msg00018.html
- https://pypi.org/project/setuptools
- https://github.com/advisories/GHSA-cx63-2mw6-8hw5
CVE-2024-6345 · published · modified · JSON