Threats affecting pkg:brew/yamlfix

A vulnerability in setuptools on Windows allows attacker-controlled content in a wheel's .dist-info/namespace_packages.txt to cause legacy wheel installation to create an __init__.py file outside the intended installation directory. The created file has fixed content and is placed at a filesystem path influenced by the wheel, with the permissions of the installing process. This requires the target parent directory to already exist.

A Unicode normalization mismatch in setuptools' handling of MANIFEST.in exclusions can cause files intended to be excluded from source distributions to be included instead. This occurs on macOS APFS/HFS+ filesystems where filenames are stored in NFD form but MANIFEST.in patterns are typically in NFC form, leading to silent exclusion bypasses. This can result in unintended disclosure of sensitive files when publishing to PyPI.

A path traversal vulnerability in setuptools' PackageIndex.download function allows an attacker to write files to arbitrary filesystem locations with the permissions of the running process. The flaw arises from insufficient sanitization of URL-derived filenames used in os.path.join, enabling path traversal despite some replacement of '..' sequences. This vulnerability was fixed in setuptools version 1.17.0_1. Exploitation could lead to arbitrary file write and potentially remote code execution depending on context. The affected component is deprecated, reducing the attack surface.