Security: CVE-2025-47273 - Path Traversal Vulnerability in PackageIndex

[vinaysamalla02]

I am trying to remediate CVE-2025-47273 by upgrading setuptools to version 78.1.1 or later, but the upgrade did not resolve the vulnerability in my environment.

Details:

• Attempted upgrade to: setuptools 78.1.1 (and later)

Questions:

• Is there a plan or timeline for updating/removing the vulnerable setuptools version from embedded wheels?
• Will there be a patch or release to address this?
• Are there any recommended workarounds until a fix is released?

[webknjaz]

but the upgrade did not resolve the vulnerability in my environment.

Can you prove this?