The setuptools package applied MANIFEST.in exclude, global-exclude, recursive-exclude, and prune directives by matching compiled glob patterns against on-disk file names without Unicode normalization. On macOS APFS or HFS+ file systems, file names stored in Normalization Form D (NFD) could bypass exclusion rules written in Normalization Form C (NFC), resulting in those files being included in source distributions when they should have been excluded. This vulnerability affects setuptools versions prior to 83.0.0 and is resolved by normalizing file names before pattern matching in version 83.0.0.

This vulnerability can lead to unintended files being included in source distributions on macOS systems using APFS or HFS+ file systems. This may expose sensitive or unwanted files in distributed packages, potentially leading to information disclosure. There is no indication of integrity or availability impact. The CVSS vector indicates local attack vector with low attack complexity, no privileges required, user interaction required, and high confidentiality impact but low integrity and availability impact.

Upgrade setuptools to version 83.0.0 or later, where the issue is fixed by applying Unicode normalization before matching file names against exclusion patterns. No other mitigation is indicated.