A command injection vulnerability exists in the package_index module of pypa/setuptools versions up to 69.1.1, allowing remote code execution via malicious package URLs. This flaw is fixed in version 70.0. The affected product 'ccm' versions >=3.1.5_3 and <3.1.5_4 are vulnerable. The vulnerability has a high severity CVSS score of 8.8.