CVE-2026-5271

Summary

pymanager included the current working directory in sys.path meaning modules could be shadowed by modules in the current working directory. As a result, if a user executes a pymanager-generated command (e.g., pip, pytest) from an attacker-controlled directory, a malicious module in that directory can be imported and executed instead of the intended package.

Affected Software

Weaknesses

ADP Enrichment

CISA ADP Vulnrichment

• SSVC:
• Exploitation: poc
  • Automatable: no
  • Technical Impact: partial

Additional References

• https://github.com/python/pymanager/security/advisories/GHSA-jr5x-hgm4-rrm6

CVE Program Container

Additional References

• http://www.openwall.com/lists/oss-security/2026/04/01/5

References

• https://github.com/python/pymanager/security/advisories/GHSA-jr5x-hgm4-rrm6

• ←Previous
• Next→