Threats affecting pkg:brew/neovim-remote

A vulnerability in setuptools on Windows allows an attacker to craft a wheel file with a malicious namespace_packages.txt that causes setuptools' legacy wheel installation to create an __init__.py file outside the intended installation directory. This file has fixed content and is created with the permissions of the installing process. The issue arises because an absolute Windows path in namespace_packages.txt bypasses normal path validation during installation.

The msgpack-python C extension has a memory leak vulnerability triggered when deserialization rejects a map key under strict_map_key validation. This causes unbounded memory growth and potential denial of service when processing attacker-controlled MessagePack data. Additionally, the streaming Unpacker API may suffer from a use-after-free due to stale parser-stack references. The issue affects version 1.2.2 and development commits, with a fix available in version 2.5.1_6.

A Unicode normalization mismatch in setuptools' handling of MANIFEST.in exclusion rules on macOS APFS/HFS+ filesystems can cause excluded files with non-ASCII names to be mistakenly included in source distributions. This occurs because the file matching is done byte-for-byte without Unicode normalization, allowing files named with decomposed Unicode (NFD) to bypass exclusion rules written in composed form (NFC). This can lead to unintended disclosure of sensitive files when publishing to PyPI.

A path traversal vulnerability in setuptools' PackageIndex.download function allows an attacker to write files to arbitrary filesystem locations with the permissions of the running Python process. This flaw arises due to insufficient sanitization of filenames derived from URLs, enabling os.path.join to be bypassed. The issue was fixed in setuptools version 78.1.1 (corresponding to neovim-remote version 2.5.1_3). Exploitation could lead to remote code execution depending on the context. The vulnerability affects neovim-remote versions >=2.5.1_1 and <2.5.1_3. The CVSS 4.0 score is 8.7 (high severity).

CVE-2024-6345 is a high-severity vulnerability in the setuptools package_index module up to version 69.1.1, allowing remote code execution via malicious package URLs. This flaw enables arbitrary command execution if user-controlled URLs are processed by the download functions. The issue is fixed in setuptools version 70.0. The neovim-remote product versions >=2.5.1_1 and <2.5.1_2 are affected and a patch is available in 2.5.1_2.