CVE-2026-5271

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-5271

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-5271.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-5271

Aliases

GHSA-jr5x-hgm4-rrm6

Published

2026-04-01T13:48:07.534Z

Modified

2026-08-12T03:51:11.099733291Z

Severity

5.6 (Medium) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

Possible to hijack modules in current working directory

Details

pymanager included the current working directory in sys.path meaning modules could be shadowed by modules in the current working directory. As a result, if a user executes a pymanager-generated command (e.g., pip, pytest) from an attacker-controlled directory, a malicious module in that directory can be imported and executed instead of the intended package.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/5xxx/CVE-2026-5271.json",
    "cna_assigner": "PSF"
}

References

Affected packages

Git / github.com/python/pymanager

Affected ranges

Type

GIT

Repo

https://github.com/python/pymanager

Events

Introduced

c6ee3eb22517949165c32d09c17f0c59f2aa3107

Fixed

75c7c3531d74d1835088508ec02eafa90aa7a0f6

Database specific

Show details

{
    "cpe": "cpe:2.3:a:python:pymanager:26.0:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "26.0"
        },
        {
            "fixed": "26.1"
        },
        {
            "last_affected": "26.0"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "CPE_STRING"
    ]
}

Affected versions

26.*

26.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-5271.json"