{"id":"CVE-2026-5271","summary":"Possible to hijack modules in current working directory","details":"pymanager included the current working directory in sys.path meaning modules could be shadowed by modules in the current working directory. As a result, if a user executes a pymanager-generated command (e.g., pip, pytest)\n from an attacker-controlled directory, a malicious module in that \ndirectory can be imported and executed instead of the intended package.","aliases":["GHSA-jr5x-hgm4-rrm6"],"modified":"2026-08-12T03:51:11.099733291Z","published":"2026-04-01T13:48:07.534Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/5xxx/CVE-2026-5271.json","cna_assigner":"PSF"},"references":[{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2026/04/01/5"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/5xxx/CVE-2026-5271.json"},{"type":"ADVISORY","url":"https://github.com/python/pymanager/security/advisories/GHSA-jr5x-hgm4-rrm6"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-5271"},{"type":"PACKAGE","url":"https://github.com/python/pymanager"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/python/pymanager","events":[{"introduced":"c6ee3eb22517949165c32d09c17f0c59f2aa3107"},{"fixed":"75c7c3531d74d1835088508ec02eafa90aa7a0f6"}],"database_specific":{"source":["AFFECTED_FIELD","CPE_STRING"],"cpe":"cpe:2.3:a:python:pymanager:26.0:*:*:*:*:*:*:*","extracted_events":[{"introduced":"26.0"},{"fixed":"26.1"},{"last_affected":"26.0"}]}}],"versions":["26.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-5271.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N"}]}