Threats tagged 'brew-python@3.11-cve-2026-59890'

A Unicode normalization mismatch in setuptools' handling of MANIFEST.in exclusions can cause files intended to be excluded from source distributions to be included instead on macOS APFS/HFS+ filesystems. This occurs because setuptools matches file names byte-for-byte without Unicode normalization, leading to exclusion bypass when file names differ only in Unicode normalization form (NFC vs NFD). This can result in unintended disclosure of files containing secrets or private data when publishing to PyPI.