Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-qt3x-msd9-tyct
Vulnerability ID VCID-qt3x-msd9-tyct
Aliases CVE-2024-6345
GHSA-cx63-2mw6-8hw5
Summary setuptools vulnerable to Command Injection via package URL A vulnerability in the `package_index` module of pypa/setuptools versions up to 69.1.1 allows for remote code execution via its download functions. These functions, which are used to download packages from URLs provided by users or retrieved from package index servers, are susceptible to code injection. If these functions are exposed to user-controlled inputs, such as package URLs, they can execute arbitrary commands on the system. The issue is fixed in version 70.0.
Status Published
Exploitability 0.5
Weighted Severity 8.0
Risk 4.0
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-94 Improper Control of Generation of Code ('Code Injection')
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3 8.8 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-6345.json
epss 0.05553 https://api.first.org/data/v1/epss?cve=CVE-2024-6345
epss 0.05553 https://api.first.org/data/v1/epss?cve=CVE-2024-6345
epss 0.05553 https://api.first.org/data/v1/epss?cve=CVE-2024-6345
epss 0.05553 https://api.first.org/data/v1/epss?cve=CVE-2024-6345
epss 0.05553 https://api.first.org/data/v1/epss?cve=CVE-2024-6345
epss 0.05553 https://api.first.org/data/v1/epss?cve=CVE-2024-6345
epss 0.05553 https://api.first.org/data/v1/epss?cve=CVE-2024-6345
epss 0.05697 https://api.first.org/data/v1/epss?cve=CVE-2024-6345
epss 0.05697 https://api.first.org/data/v1/epss?cve=CVE-2024-6345
epss 0.05697 https://api.first.org/data/v1/epss?cve=CVE-2024-6345
epss 0.05697 https://api.first.org/data/v1/epss?cve=CVE-2024-6345
epss 0.07336 https://api.first.org/data/v1/epss?cve=CVE-2024-6345
epss 0.07336 https://api.first.org/data/v1/epss?cve=CVE-2024-6345
cvssv3.1 7 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv3.1_qr HIGH https://github.com/advisories/GHSA-cx63-2mw6-8hw5
cvssv3.1 8.8 https://github.com/pypa/setuptools
cvssv4 7.5 https://github.com/pypa/setuptools
generic_textual HIGH https://github.com/pypa/setuptools
cvssv3 8.8 https://github.com/pypa/setuptools/commit/88807c7062788254f654ea8c03427adc859321f0
cvssv3.1 8.8 https://github.com/pypa/setuptools/commit/88807c7062788254f654ea8c03427adc859321f0
cvssv4 7.5 https://github.com/pypa/setuptools/commit/88807c7062788254f654ea8c03427adc859321f0
generic_textual HIGH https://github.com/pypa/setuptools/commit/88807c7062788254f654ea8c03427adc859321f0
ssvc Track* https://github.com/pypa/setuptools/commit/88807c7062788254f654ea8c03427adc859321f0
cvssv3.1 8.8 https://github.com/pypa/setuptools/pull/4332
cvssv4 7.5 https://github.com/pypa/setuptools/pull/4332
generic_textual HIGH https://github.com/pypa/setuptools/pull/4332
cvssv3 8.8 https://huntr.com/bounties/d6362117-ad57-4e83-951f-b8141c6e7ca5
cvssv3.1 8.8 https://huntr.com/bounties/d6362117-ad57-4e83-951f-b8141c6e7ca5
cvssv4 7.5 https://huntr.com/bounties/d6362117-ad57-4e83-951f-b8141c6e7ca5
generic_textual HIGH https://huntr.com/bounties/d6362117-ad57-4e83-951f-b8141c6e7ca5
ssvc Track* https://huntr.com/bounties/d6362117-ad57-4e83-951f-b8141c6e7ca5
cvssv3.1 8.8 https://lists.debian.org/debian-lts-announce/2024/09/msg00018.html
cvssv4 7.5 https://lists.debian.org/debian-lts-announce/2024/09/msg00018.html
generic_textual HIGH https://lists.debian.org/debian-lts-announce/2024/09/msg00018.html
cvssv3.1 8.8 https://nvd.nist.gov/vuln/detail/CVE-2024-6345
cvssv4 7.5 https://nvd.nist.gov/vuln/detail/CVE-2024-6345
generic_textual HIGH https://nvd.nist.gov/vuln/detail/CVE-2024-6345
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-6345.json
https://api.first.org/data/v1/epss?cve=CVE-2024-6345
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-6345
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
https://github.com/pypa/setuptools
https://github.com/pypa/setuptools/commit/88807c7062788254f654ea8c03427adc859321f0
https://github.com/pypa/setuptools/pull/4332
https://huntr.com/bounties/d6362117-ad57-4e83-951f-b8141c6e7ca5
https://lists.debian.org/debian-lts-announce/2024/09/msg00018.html
https://nvd.nist.gov/vuln/detail/CVE-2024-6345
2297771 https://bugzilla.redhat.com/show_bug.cgi?id=2297771
GHSA-cx63-2mw6-8hw5 https://github.com/advisories/GHSA-cx63-2mw6-8hw5
RHSA-2024:10135 https://access.redhat.com/errata/RHSA-2024:10135
RHSA-2024:11109 https://access.redhat.com/errata/RHSA-2024:11109
RHSA-2024:5000 https://access.redhat.com/errata/RHSA-2024:5000
RHSA-2024:5002 https://access.redhat.com/errata/RHSA-2024:5002
RHSA-2024:5040 https://access.redhat.com/errata/RHSA-2024:5040
RHSA-2024:5078 https://access.redhat.com/errata/RHSA-2024:5078
RHSA-2024:5084 https://access.redhat.com/errata/RHSA-2024:5084
RHSA-2024:5137 https://access.redhat.com/errata/RHSA-2024:5137
RHSA-2024:5279 https://access.redhat.com/errata/RHSA-2024:5279
RHSA-2024:5389 https://access.redhat.com/errata/RHSA-2024:5389
RHSA-2024:5530 https://access.redhat.com/errata/RHSA-2024:5530
RHSA-2024:5531 https://access.redhat.com/errata/RHSA-2024:5531
RHSA-2024:5532 https://access.redhat.com/errata/RHSA-2024:5532
RHSA-2024:5533 https://access.redhat.com/errata/RHSA-2024:5533
RHSA-2024:5534 https://access.redhat.com/errata/RHSA-2024:5534
RHSA-2024:5962 https://access.redhat.com/errata/RHSA-2024:5962
RHSA-2024:6220 https://access.redhat.com/errata/RHSA-2024:6220
RHSA-2024:6309 https://access.redhat.com/errata/RHSA-2024:6309
RHSA-2024:6311 https://access.redhat.com/errata/RHSA-2024:6311
RHSA-2024:6312 https://access.redhat.com/errata/RHSA-2024:6312
RHSA-2024:6488 https://access.redhat.com/errata/RHSA-2024:6488
RHSA-2024:6611 https://access.redhat.com/errata/RHSA-2024:6611
RHSA-2024:6612 https://access.redhat.com/errata/RHSA-2024:6612
RHSA-2024:6661 https://access.redhat.com/errata/RHSA-2024:6661
RHSA-2024:6662 https://access.redhat.com/errata/RHSA-2024:6662
RHSA-2024:6667 https://access.redhat.com/errata/RHSA-2024:6667
RHSA-2024:6726 https://access.redhat.com/errata/RHSA-2024:6726
RHSA-2024:6907 https://access.redhat.com/errata/RHSA-2024:6907
RHSA-2024:7213 https://access.redhat.com/errata/RHSA-2024:7213
RHSA-2024:7374 https://access.redhat.com/errata/RHSA-2024:7374
RHSA-2024:8168 https://access.redhat.com/errata/RHSA-2024:8168
RHSA-2024:8170 https://access.redhat.com/errata/RHSA-2024:8170
RHSA-2024:8171 https://access.redhat.com/errata/RHSA-2024:8171
RHSA-2024:8172 https://access.redhat.com/errata/RHSA-2024:8172
RHSA-2024:8173 https://access.redhat.com/errata/RHSA-2024:8173
RHSA-2024:8179 https://access.redhat.com/errata/RHSA-2024:8179
USN-7002-1 https://usn.ubuntu.com/7002-1/
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-6345.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://github.com/pypa/setuptools
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N Found at https://github.com/pypa/setuptools
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://github.com/pypa/setuptools/commit/88807c7062788254f654ea8c03427adc859321f0
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://github.com/pypa/setuptools/commit/88807c7062788254f654ea8c03427adc859321f0
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N Found at https://github.com/pypa/setuptools/commit/88807c7062788254f654ea8c03427adc859321f0
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2024-07-15T13:33:16Z/ Found at https://github.com/pypa/setuptools/commit/88807c7062788254f654ea8c03427adc859321f0
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://github.com/pypa/setuptools/pull/4332
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N Found at https://github.com/pypa/setuptools/pull/4332
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://huntr.com/bounties/d6362117-ad57-4e83-951f-b8141c6e7ca5
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://huntr.com/bounties/d6362117-ad57-4e83-951f-b8141c6e7ca5
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N Found at https://huntr.com/bounties/d6362117-ad57-4e83-951f-b8141c6e7ca5
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2024-07-15T13:33:16Z/ Found at https://huntr.com/bounties/d6362117-ad57-4e83-951f-b8141c6e7ca5
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://lists.debian.org/debian-lts-announce/2024/09/msg00018.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N Found at https://lists.debian.org/debian-lts-announce/2024/09/msg00018.html
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2024-6345
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N Found at https://nvd.nist.gov/vuln/detail/CVE-2024-6345
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.90251
EPSS Score 0.05553
Published At April 7, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-04-01T12:51:30.217509+00:00 GithubOSV Importer Import https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/07/GHSA-cx63-2mw6-8hw5/GHSA-cx63-2mw6-8hw5.json 38.0.0