📄 Description (English)
pymanager included the current working directory in sys.path meaning modules could be shadowed by modules in the current working directory. As a result, if a user executes a pymanager-generated command (e.g., pip, pytest)
from an attacker-controlled directory, a malicious module in that
directory can be imported and executed instead of the intended package.
🤖
Queued for AI Analysis
This CVE will be auto-analyzed on the next cron run.
🔗 References & Sources 3
🔗
https://github.com/python/pymanager/security/advisories/GHSA-jr5x-hgm4-rrm6
cna@python.org
Exploit
Vendor Advisory
🔗
http://www.openwall.com/lists/oss-security/2026/04/01/5
af854a3a-2127-422b-91ae-364da2661108
Mailing List
Third Party Advisory
🔗
https://github.com/python/pymanager/security/advisories/GHSA-jr5x-hgm4-rrm6
134c704f-9b21-4f2e-91b3-4a467353bcc0
Exploit
Vendor Advisory
📦 Affected Products / CPE 1 entries
python:pymanager:26.0