PT-2026-29526 · Pymanager · Pymanager

Lakshmikanthan K + 1 · Published 2026-04-01 · Updated 2026-04-01 · CVE-2026-5271

Positive Technologies · (AI Summary)

CVSS v4.0

5.6

Medium

AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions pymanager (affected versions not specified)

Description pymanager included the current working directory in its sys.path, allowing modules in the current working directory to shadow intended packages. If a user runs a pymanager-generated command (like pip or pytest) from a directory controlled by an attacker, a malicious module in that directory could be imported and executed instead of the legitimate package.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Uncontrolled Search Path Element

Weakness Enumeration

CWE-427

Related Identifiers

CVE-2026-5271

Affected Products

Pymanager

References · 5

• 🔥 https://github.com/python/pymanager/security/advisories/GHSA-jr5x-hgm4-rrm6 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-5271 · Security Note
• http://openwall.com/lists/oss-security/2026/04/01/5 · Note
• https://twitter.com/CVEnew/status/2039372053749342223 · Twitter Post
• https://twitter.com/cyberbivash/status/2039369550307725612 · Twitter Post