Vulnerability Description
pymanager included the current working directory in sys.path meaning modules could be shadowed by modules in the current working directory. As a result, if a user executes a pymanager-generated command (e.g., pip, pytest) from an attacker-controlled directory, a malicious module in that directory can be imported and executed instead of the intended package.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Python | Pymanager | 26.0 |
Related Weaknesses (CWE)
References
- https://github.com/python/pymanager/security/advisories/GHSA-jr5x-hgm4-rrm6ExploitVendor Advisory
- http://www.openwall.com/lists/oss-security/2026/04/01/5Mailing ListThird Party Advisory
- https://github.com/python/pymanager/security/advisories/GHSA-jr5x-hgm4-rrm6ExploitVendor Advisory
FAQ
What is CVE-2026-5271?
CVE-2026-5271 is a vulnerability with a CVSS score of 7.8 (HIGH). pymanager included the current working directory in sys.path meaning modules could be shadowed by modules in the current working directory. As a result, if a user executes a pymanager-generated comman...
How severe is CVE-2026-5271?
CVE-2026-5271 has been rated HIGH with a CVSS base score of 7.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-5271?
Check the references section above for vendor advisories and patch information. Affected products include: Python Pymanager.