N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-94v7-wxj6-r2q5

GHSA-94v7-wxj6-r2q5: multicast in source builds from vulnerable setuptools dependency

Impact

Some source-builds may be impacted by a CWE-1395 (eg. vulnerable setuptools dependency).
- Multicast prior to v2.0.9a3 on systems with minimal dependancies installed may use setuptools <78.1.1 and thus rely on a compromised dependency. In some cases there is a chance that source-builds would fail due to an exploit of the closely related CVE-2025-47273, or become arbitrarily modified.

Patches

Pre-release version v2.0.9a0 and later resolve the issue by bumping requirements to setuptools>=80.4
- Pre-release version v2.0.9a3 and later are recommended for improved stability over v2.0.9a0

Workarounds

Further hardening in v2.0.9a4+ of the build process in CI builds allowing source builds to be verified via GH attestations.

References

GHSA-5rjg-fvgr-3xxf
pypa/setuptools#4946

Fixes

https://github.com/reactive-firewall/multicast/blob/c5c7c7de272421d944beca8452871bca6bfd151f/tests/requirements.txt#L32
https://github.com/reactive-firewall/multicast/blob/c5c7c7de272421d944beca8452871bca6bfd151f/docs/requirements.txt#L27
https://github.com/reactive-firewall/multicast/blob/c5c7c7de272421d944beca8452871bca6bfd151f/requirements.txt#L26
https://github.com/reactive-firewall/multicast/blob/c5c7c7de272421d944beca8452871bca6bfd151f/pyproject.toml#L2

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-94v7-wxj6-r2q5

GHSA-94v7-wxj6-r2q5:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
multicast	pip	< 2.0.9a0	2.0.9a0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability GHSA-94v7-wxj6-r2q5 in reactive-firewall/multicast was due to a dependency on a vulnerable version of setuptools (CWE-1395). The exploit scenario involves a compromised build process if multicast (before v2.0.9a0) is built from source using a malicious setuptools version.

The identified 'vulnerable functions' are components of the setup.py script that was part of multicast's build system prior to the fix. These functions (readFile, parse_requirements_for_install_requires) and the main execution block of setup.py were not intrinsically flawed but were the parts of multicast's build infrastructure that would execute and interact with the setuptools library. During a compromised build, these script components would be on the execution path leading to or involving the vulnerable setuptools dependency, and thus would appear in a runtime profile of that malicious build process.

The fix, implemented in commit c5c7c7de272421d944beca8452871bca6bfd151f, involved removing setup.py entirely, adopting a pyproject.toml-based build system (PEP 621), and explicitly requiring a patched version of setuptools (>=80.4). This change in build methodology and dependency versioning directly addresses the vulnerability by ensuring a secure version of setuptools is used and by moving away from the legacy setup.py execution model.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.