CVE-2026-5271 | BDVDB-2026-324103 Detail

Description#

pymanager included the current working directory in sys.path meaning modules could be shadowed by modules in the current working directory. As a result, if a user executes a pymanager-generated command (e.g., pip, pytest) from an attacker-controlled directory, a malicious module in that directory can be imported and executed instead of the intended package.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12026-04-01Record published in the CVE List.