René's URL Explorer Experiment


Title: Update dependency setuptools to v78 [SECURITY] by renovate[bot] · Pull Request #36 · protoconf/client-python · GitHub

Open Graph Title: Update dependency setuptools to v78 [SECURITY] by renovate[bot] · Pull Request #36 · protoconf/client-python

X Title: Update dependency setuptools to v78 [SECURITY] by renovate[bot] · Pull Request #36 · protoconf/client-python

Description: This PR contains the following updates: Package Change Age Confidence setuptools (changelog) ==74.0.0 → ==78.1.1 GitHub Vulnerability Alerts CVE-2025-47273 Summary A path traversal vulnerability in PackageIndex was fixed in setuptools version 78.1.1 Details def _download_url(self, url, tmpdir): # Determine download filename # name, _fragment = egg_info_for_url(url) if name: while '..' in name: name = name.replace('..', '.').replace('\\', '_') else: name = "__downloaded__" # default if URL has no path contents if name.endswith('.[egg.zip](http://egg.zip/)'): name = name[:-4] # strip the extra .zip before download --> filename = os.path.join(tmpdir, name) Here: https://github.com/pypa/setuptools/blob/6ead555c5fb29bc57fe6105b1bffc163f56fd558/setuptools/package_index.py#L810C1-L825C88 os.path.join() discards the first argument tmpdir if the second begins with a slash or drive letter. name is derived from a URL without sufficient sanitization. While there is some attempt to sanitize by replacing instances of '..' with '.', it is insufficient. Risk Assessment As easy_install and package_index are deprecated, the exploitation surface is reduced. However, it seems this could be exploited in a similar fashion like GHSA-r9hx-vwmv-q579, and as described by POC 4 in GHSA-cx63-2mw6-8hw5 report: via malicious URLs present on the pages of a package index. Impact An attacker would be allowed to write files to arbitrary locations on the filesystem with the permissions of the process running the Python code, which could escalate to RCE depending on the context. References https://huntr.com/bounties/d6362117-ad57-4e83-951f-b8141c6e7ca5 https://github.com/pypa/setuptools/issues/4946 Release Notes pypa/setuptools (setuptools) v78.1.1 Compare Source v78.1.0 Compare Source v78.0.2 Compare Source v78.0.1 Compare Source v77.0.3 Compare Source v77.0.1 Compare Source v76.1.0 Compare Source v76.0.0 Compare Source v75.9.1 Compare Source v75.9.0 Compare Source v75.8.2 Compare Source v75.8.1 Compare Source v75.8.0 Compare Source v75.7.0 Compare Source v75.6.0 Compare Source v75.5.0 Compare Source v75.4.0 Compare Source v75.3.2 Compare Source v75.3.1 Compare Source v75.3.0 Compare Source v75.2.0 Compare Source v75.1.0 Compare Source v75.0.0 Compare Source v74.1.3 Compare Source v74.1.2 Compare Source v74.1.1 Compare Source v74.1.0 Compare Source Configuration 📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined). 🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied. ♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 Ignore: Close this PR and you won't be reminded about this update again. If you want to rebase/retry this PR, check this box This PR was generated by Mend Renovate. View the repository job log.

Open Graph Description: This PR contains the following updates: Package Change Age Confidence setuptools (changelog) ==74.0.0 → ==78.1.1 GitHub Vulnerability Alerts CVE-2025-47273 Summary A path traversal vuln...

X Description: This PR contains the following updates: Package Change Age Confidence setuptools (changelog) ==74.0.0 → ==78.1.1 GitHub Vulnerability Alerts CVE-2025-47273 Summary A path traversal vuln...

Opengraph URL: https://github.com/protoconf/client-python/pull/36

X: @github

direct link

Domain: patch-diff.githubusercontent.com

route-pattern/:user_id/:repository/pull/:id/checks(.:format)
route-controllerpull_requests
route-actionchecks
fetch-noncev2:1b60b0b8-fb8e-c9ac-06b7-97f55f914a92
current-catalog-service-hash87dc3bc62d9b466312751bfd5f889726f4f1337bdff4e8be7da7c93d6c00a25a
request-idDBF8:40A88:E29A6C:12B0C18:69804AC7
html-safe-noncec85d98907d33f9a88aa015dbfdc81de40f849558c3ba6def0b3556a7ea1cef2f
visitor-payloadeyJyZWZlcnJlciI6IiIsInJlcXVlc3RfaWQiOiJEQkY4OjQwQTg4OkUyOUE2QzoxMkIwQzE4OjY5ODA0QUM3IiwidmlzaXRvcl9pZCI6IjEyMTEwOTM2MzQzNTU1Nzk1OTEiLCJyZWdpb25fZWRnZSI6ImlhZCIsInJlZ2lvbl9yZW5kZXIiOiJpYWQifQ==
visitor-hmac6ce5bbc454afa6fe159965b1b92ca2a850b1ebbca247b01def0fd2b53daa88df
hovercard-subject-tagpull_request:2529757788
github-keyboard-shortcutsrepository,pull-request-list,pull-request-conversation,pull-request-files-changed,checks,copilot
google-site-verificationApib7-x98H0j5cPqHWwSMm6dNU4GmODRoqxLiDzdx9I
octolytics-urlhttps://collector.github.com/github/collect
analytics-location///pull_requests/show/checks
fb:app_id1401488693436528
apple-itunes-appapp-id=1477376905, app-argument=https://github.com/protoconf/client-python/pull/36/checks
twitter:imagehttps://avatars.githubusercontent.com/in/2740?s=400&v=4
twitter:cardsummary_large_image
og:imagehttps://avatars.githubusercontent.com/in/2740?s=400&v=4
og:image:altThis PR contains the following updates: Package Change Age Confidence setuptools (changelog) ==74.0.0 → ==78.1.1 GitHub Vulnerability Alerts CVE-2025-47273 Summary A path traversal vuln...
og:site_nameGitHub
og:typeobject
hostnamegithub.com
expected-hostnamegithub.com
None60279d4097367e16897439d16d6bbe4180663db828c666eeed2656988ffe59f6
turbo-cache-controlno-preview
go-importgithub.com/protoconf/client-python git https://github.com/protoconf/client-python.git
octolytics-dimension-user_id51154987
octolytics-dimension-user_loginprotoconf
octolytics-dimension-repository_id820059494
octolytics-dimension-repository_nwoprotoconf/client-python
octolytics-dimension-repository_publictrue
octolytics-dimension-repository_is_forkfalse
octolytics-dimension-repository_network_root_id820059494
octolytics-dimension-repository_network_root_nwoprotoconf/client-python
turbo-body-classeslogged-out env-production page-responsive full-width full-width-p-0
disable-turbofalse
browser-stats-urlhttps://api.github.com/_private/browser/stats
browser-errors-urlhttps://api.github.com/_private/browser/errors
release7c85641c598ad130c74f7bcc27f58575cac69551
ui-targetfull
theme-color#1e2327
color-schemelight dark

Links:

Skip to contenthttps://patch-diff.githubusercontent.com/protoconf/client-python/pull/36/checks#start-of-content
https://patch-diff.githubusercontent.com/
Sign in https://patch-diff.githubusercontent.com/login?return_to=https%3A%2F%2Fgithub.com%2Fprotoconf%2Fclient-python%2Fpull%2F36%2Fchecks
GitHub CopilotWrite better code with AIhttps://github.com/features/copilot
GitHub SparkBuild and deploy intelligent appshttps://github.com/features/spark
GitHub ModelsManage and compare promptshttps://github.com/features/models
MCP RegistryNewIntegrate external toolshttps://github.com/mcp
ActionsAutomate any workflowhttps://github.com/features/actions
CodespacesInstant dev environmentshttps://github.com/features/codespaces
IssuesPlan and track workhttps://github.com/features/issues
Code ReviewManage code changeshttps://github.com/features/code-review
GitHub Advanced SecurityFind and fix vulnerabilitieshttps://github.com/security/advanced-security
Code securitySecure your code as you buildhttps://github.com/security/advanced-security/code-security
Secret protectionStop leaks before they starthttps://github.com/security/advanced-security/secret-protection
Why GitHubhttps://github.com/why-github
Documentationhttps://docs.github.com
Bloghttps://github.blog
Changeloghttps://github.blog/changelog
Marketplacehttps://github.com/marketplace
View all featureshttps://github.com/features
Enterpriseshttps://github.com/enterprise
Small and medium teamshttps://github.com/team
Startupshttps://github.com/enterprise/startups
Nonprofitshttps://github.com/solutions/industry/nonprofits
App Modernizationhttps://github.com/solutions/use-case/app-modernization
DevSecOpshttps://github.com/solutions/use-case/devsecops
DevOpshttps://github.com/solutions/use-case/devops
CI/CDhttps://github.com/solutions/use-case/ci-cd
View all use caseshttps://github.com/solutions/use-case
Healthcarehttps://github.com/solutions/industry/healthcare
Financial serviceshttps://github.com/solutions/industry/financial-services
Manufacturinghttps://github.com/solutions/industry/manufacturing
Governmenthttps://github.com/solutions/industry/government
View all industrieshttps://github.com/solutions/industry
View all solutionshttps://github.com/solutions
AIhttps://github.com/resources/articles?topic=ai
Software Developmenthttps://github.com/resources/articles?topic=software-development
DevOpshttps://github.com/resources/articles?topic=devops
Securityhttps://github.com/resources/articles?topic=security
View all topicshttps://github.com/resources/articles
Customer storieshttps://github.com/customer-stories
Events & webinarshttps://github.com/resources/events
Ebooks & reportshttps://github.com/resources/whitepapers
Business insightshttps://github.com/solutions/executive-insights
GitHub Skillshttps://skills.github.com
Documentationhttps://docs.github.com
Customer supporthttps://support.github.com
Community forumhttps://github.com/orgs/community/discussions
Trust centerhttps://github.com/trust-center
Partnershttps://github.com/partners
GitHub SponsorsFund open source developershttps://github.com/sponsors
Security Labhttps://securitylab.github.com
Maintainer Communityhttps://maintainers.github.com
Acceleratorhttps://github.com/accelerator
Archive Programhttps://archiveprogram.github.com
Topicshttps://github.com/topics
Trendinghttps://github.com/trending
Collectionshttps://github.com/collections
Enterprise platformAI-powered developer platformhttps://github.com/enterprise
GitHub Advanced SecurityEnterprise-grade security featureshttps://github.com/security/advanced-security
Copilot for BusinessEnterprise-grade AI featureshttps://github.com/features/copilot/copilot-business
Premium SupportEnterprise-grade 24/7 supporthttps://github.com/premium-support
Pricinghttps://github.com/pricing
Search syntax tipshttps://docs.github.com/search-github/github-code-search/understanding-github-code-search-syntax
documentationhttps://docs.github.com/search-github/github-code-search/understanding-github-code-search-syntax
Sign in https://patch-diff.githubusercontent.com/login?return_to=https%3A%2F%2Fgithub.com%2Fprotoconf%2Fclient-python%2Fpull%2F36%2Fchecks
Sign up https://patch-diff.githubusercontent.com/signup?ref_cta=Sign+up&ref_loc=header+logged+out&ref_page=%2F%3Cuser-name%3E%2F%3Crepo-name%3E%2Fpull_requests%2Fshow%2Fchecks&source=header-repo&source_repo=protoconf%2Fclient-python
Reloadhttps://patch-diff.githubusercontent.com/protoconf/client-python/pull/36/checks
Reloadhttps://patch-diff.githubusercontent.com/protoconf/client-python/pull/36/checks
Reloadhttps://patch-diff.githubusercontent.com/protoconf/client-python/pull/36/checks
protoconf https://patch-diff.githubusercontent.com/protoconf
client-pythonhttps://patch-diff.githubusercontent.com/protoconf/client-python
Notifications https://patch-diff.githubusercontent.com/login?return_to=%2Fprotoconf%2Fclient-python
Fork 0 https://patch-diff.githubusercontent.com/login?return_to=%2Fprotoconf%2Fclient-python
Star 3 https://patch-diff.githubusercontent.com/login?return_to=%2Fprotoconf%2Fclient-python
Code https://patch-diff.githubusercontent.com/protoconf/client-python
Issues 1 https://patch-diff.githubusercontent.com/protoconf/client-python/issues
Pull requests 15 https://patch-diff.githubusercontent.com/protoconf/client-python/pulls
Actions https://patch-diff.githubusercontent.com/protoconf/client-python/actions
Projects 0 https://patch-diff.githubusercontent.com/protoconf/client-python/projects
Security 0 https://patch-diff.githubusercontent.com/protoconf/client-python/security
Insights https://patch-diff.githubusercontent.com/protoconf/client-python/pulse
Code https://patch-diff.githubusercontent.com/protoconf/client-python
Issues https://patch-diff.githubusercontent.com/protoconf/client-python/issues
Pull requests https://patch-diff.githubusercontent.com/protoconf/client-python/pulls
Actions https://patch-diff.githubusercontent.com/protoconf/client-python/actions
Projects https://patch-diff.githubusercontent.com/protoconf/client-python/projects
Security https://patch-diff.githubusercontent.com/protoconf/client-python/security
Insights https://patch-diff.githubusercontent.com/protoconf/client-python/pulse
Sign up for GitHub https://patch-diff.githubusercontent.com/signup?return_to=%2Fprotoconf%2Fclient-python%2Fissues%2Fnew%2Fchoose
terms of servicehttps://docs.github.com/terms
privacy statementhttps://docs.github.com/privacy
Sign inhttps://patch-diff.githubusercontent.com/login?return_to=%2Fprotoconf%2Fclient-python%2Fissues%2Fnew%2Fchoose
renovatehttps://patch-diff.githubusercontent.com/apps/renovate
mainhttps://patch-diff.githubusercontent.com/protoconf/client-python/tree/main
renovate/pypi-setuptools-vulnerabilityhttps://patch-diff.githubusercontent.com/protoconf/client-python/tree/renovate/pypi-setuptools-vulnerability
Conversation 0 https://patch-diff.githubusercontent.com/protoconf/client-python/pull/36
Commits 1 https://patch-diff.githubusercontent.com/protoconf/client-python/pull/36/commits
Checks 2 https://patch-diff.githubusercontent.com/protoconf/client-python/pull/36/checks
Files changed https://patch-diff.githubusercontent.com/protoconf/client-python/pull/36/files
Please reload this pagehttps://patch-diff.githubusercontent.com/protoconf/client-python/pull/36/checks
Please reload this pagehttps://patch-diff.githubusercontent.com/protoconf/client-python/pull/36/checks
Update dependency setuptools to v78 [SECURITY] https://patch-diff.githubusercontent.com/protoconf/client-python/pull/36/checks#top
Please reload this pagehttps://patch-diff.githubusercontent.com/protoconf/client-python/pull/36/checks
GitGuardian Security Checks https://patch-diff.githubusercontent.com/protoconf/client-python/pull/36/checks?check_run_id=42509204128
Docker Image CI on: pull_request https://patch-diff.githubusercontent.com/protoconf/client-python/actions/runs/15122928095
build https://patch-diff.githubusercontent.com/protoconf/client-python/actions/runs/15122928095/job/42509204229?pr=36
https://github.com
Termshttps://docs.github.com/site-policy/github-terms/github-terms-of-service
Privacyhttps://docs.github.com/site-policy/privacy-policies/github-privacy-statement
Securityhttps://github.com/security
Statushttps://www.githubstatus.com/
Communityhttps://github.community/
Docshttps://docs.github.com/
Contacthttps://support.github.com?tags=dotcom-footer

Viewport: width=device-width

URLs of crawlers that visited me.