Threats affecting pkg:brew/bashate

A vulnerability in setuptools on Windows allows an attacker to craft a wheel file with a malicious namespace_packages.txt that causes setuptools to create an __init__.py file outside the intended installation directory. This file has fixed content and is created with the permissions of the installing process. The issue arises because an absolute Windows path in namespace_packages.txt is not properly validated and leads to path escape during legacy wheel installation.

A Unicode normalization mismatch in setuptools' handling of MANIFEST.in exclusion patterns causes files with non-ASCII names to bypass exclusion on macOS APFS/HFS+ filesystems. This occurs because the filesystem stores filenames in NFD form, while MANIFEST.in patterns are typically NFC, leading to byte-level mismatches and unintended inclusion of files meant to be excluded from source distributions. This can result in accidental public disclosure of sensitive files when publishing to PyPI.