Vulnerability · Published Apr 1, 2026 · Assigned by PSF
CVE-2026-5271Possible to hijack modules in current working directory
Medium 5.6
In plain English
A medium-severity uncontrolled search path in pymanager from Python Software Foundation. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 8% of all known vulnerabilities).
Official description
pymanager included the current working directory in sys.path meaning modules could be shadowed by modules in the current working directory. As a result, if a user executes a pymanager-generated command (e.g., pip, pytest) from an attacker-controlled directory, a malicious module in that directory can be imported and executed instead of the intended package.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Python Software Foundation | pymanager | 26.0 – before 26.1 |
Weakness: CWE-427 · Vector: CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N