CVE-2026-5271: python software foundation pymanager Uncontrolled Search Path Element

Vulnerability summary

CVE-2026-5271 is a high (CVSS 7.8) Uncontrolled Search Path Element vulnerability in python software foundation pymanager. EPSS estimates a 0.19% chance of exploitation in the next 30 days, higher than 7.6% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 01-04-2026
   PublishedVulnerability first disclosed.
2. 01-04-2026
   Last modifiedVulnerability information updated.

Description

pymanager included the current working directory in sys.path meaning modules could be shadowed by modules in the current working directory. As a result, if a user executes a pymanager-generated command (e.g., pip, pytest) from an attacker-controlled directory, a malicious module in that directory can be imported and executed instead of the intended package.

• CWE-427Uncontrolled Search Path ElementThe product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors.