CVE-2026-5271: Python Pymanager

High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days.

pymanager included the current working directory in sys.path meaning modules could be shadowed by modules in the current working directory. As a result, if a user executes a pymanager-generated command (e.g., pip, pytest) from an attacker-controlled directory, a malicious module in that directory can be imported and executed instead of the intended package.

Affected products

• Python Pymanager: version 26.0 only

Published 2026-04-01. Last modified 2026-06-17.