CVE-2025-8078: Remote Code Execution via CLI Command Injection

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

CVE-2025-8078 and CVE-2024-6345: Remote Code Execution Vulnerabilities CVE-2025-8078, published on October 21, 2025, details a remote code execution vulnerability via CLI command injection. Additionally, CVE-2024-6345, published on July 15, 2024, affects pypa/setuptools and had its first public proof of concept released on June 27, 2025. Both vulnerabilities pose risks to users of the affected software. 25 sources 72