Threats affecting pkg:brew/pyqt-builder

A vulnerability in setuptools on Windows allows a crafted wheel's namespace_packages.txt to cause legacy wheel installation to create an __init__.py file outside the intended installation directory. The file content is fixed and the path is attacker-influenced but requires the target directory to preexist. This can lead to unauthorized file creation with the installer's permissions.

A Unicode normalization mismatch in setuptools' handling of MANIFEST.in exclusions can cause files intended to be excluded from source distributions to be included instead. This occurs on macOS APFS/HFS+ filesystems where filenames are stored in NFD form but MANIFEST.in patterns are typically written in NFC form, causing byte-level matching to fail. As a result, sensitive files with non-ASCII names may be unintentionally published to PyPI. This issue affects setuptools versions before 1.19.1_1 and has a fix available in 1.19.1_1.

A path traversal vulnerability in setuptools' PackageIndex.download method allows an attacker to write files to arbitrary filesystem locations. This occurs because the filename derived from a URL is insufficiently sanitized, enabling traversal outside the intended temporary directory. The issue was fixed in setuptools version 1.18.1_1. Exploitation could lead to arbitrary file write with the permissions of the running process, potentially escalating to remote code execution depending on context.

CVE-2024-6345 is a high-severity vulnerability in the package_index module of pypa/setuptools up to version 69.1.1. It allows remote code execution via command injection through download functions that handle package URLs. This flaw can be exploited if these functions process user-controlled URLs, leading to arbitrary command execution on the affected system. The issue is fixed in setuptools version 70.0 and pyqt-builder versions 1.16.3 and later.