What’s Vulnerable › Vulnerabilities

CVE-2024-6345: Remote Code Execution in pypa/setuptools

• Severity: high (CVSS 8.8 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.9% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-07-15 · updated 2026-06-17
• Weakness: CWE-94

Description

A vulnerability in the package_index module of pypa/setuptools versions up to 69.1.1 allows for remote code execution via its download functions. These functions, which are used to download packages from URLs provided by users or retrieved from package index servers, are susceptible to code injection. If these functions are exposed to user-controlled inputs, such as package URLs, they can execute arbitrary commands on the system. The issue is fixed in version 70.0.

Affected products

• pypa setuptools: from 69.1.1 before 70.0 — fixed in 70.0
• Pypi Setuptools: before 70.0.0; 0.6b1, 0.6b2, 0.6b3, 0.6b4, 0.6c1, 0.6c10 (+494) — fixed in 70.0.0

How to fix

Upgrade to a fixed version: pypa setuptools 70.0; Pypi Setuptools 70.0.0. Check the vendor advisory for mitigations.

References

• https://github.com/pypa/setuptools/commit/88807c7062788254f654ea8c03427adc859321f0
• https://huntr.com/bounties/d6362117-ad57-4e83-951f-b8141c6e7ca5
• https://github.com/pypa/setuptools/commit/88807c7062788254f654ea8c03427adc859321f0
• https://huntr.com/bounties/d6362117-ad57-4e83-951f-b8141c6e7ca5
• https://lists.debian.org/debian-lts-announce/2024/09/msg00018.html

Get alerted when CVE-2024-6345 or the next vulnerability affects your stack