Is there a patch available for CVE-2026-5271?

Yes, a patch is available for CVE-2026-5271. Update the affected software to the latest version immediately.

Python CVE-2026-5271

Q: What is the CVSS score of CVE-2026-5271?

CVE-2026-5271 has a CVSS 4.0 base score of 5.6 (Medium). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-17911 MEDIUM

Uncontrolled Search Path Element (CWE-427)

2026-04-01 cna@python.org

Python Information Disclosure Pymanager

5.6

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.6 MEDIUM

CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

26.1

EUVD ID Assigned

Apr 01, 2026 - 14:22 euvd

EUVD-2026-17911

Analysis Generated

Apr 01, 2026 - 14:22 vuln.today

CVE Published

Apr 01, 2026 - 14:16 nvd

MEDIUM 5.6

DescriptionCVE.org

pymanager included the current working directory in sys.path meaning modules could be shadowed by modules in the current working directory. This could lead to modules getting shadowed

Articles & Coverage 1

letchupkt.medium.com CVE-2026-5271: Python pymanager Module Hijacking via CWD Path Manipulation

AnalysisAI

pymanager allows local attackers to shadow legitimate Python modules by placing malicious modules in the current working directory, leading to arbitrary code execution when the application imports standard library or third-party modules. The vulnerability affects pymanager due to insecure sys.path manipulation that includes the current working directory with high priority, enabling privilege escalation or information disclosure depending on the affected module and execution context. No public exploit code has been identified, but the local attack vector with low complexity makes this a practical risk in shared or untrusted execution environments.

Technical ContextAI

pymanager is a Python package management and execution tool that manipulates Python's module search path (sys.path) during initialization. The vulnerability stems from insecure handling of sys.path, where the current working directory is included early in the module resolution order, violating the principle of least privilege for module loading. This is a classic Python path injection vulnerability (related to CWE-426: Untrusted Search Path and CWE-427: Uncontrolled Search Path Element). When Python's import system searches for modules, it traverses sys.path in order; by placing a malicious module with the same name as a legitimate module in the current directory, an attacker can intercept and shadow the intended import. The CVE references GHSA-jr5x-hgm4-rrm6, indicating this was disclosed through GitHub's security advisory system.

RemediationAI

Users must update pymanager to a patched version released by the Python project. Patch availability and exact version numbers should be confirmed via the official GitHub security advisory at https://github.com/python/pymanager/security/advisories/GHSA-jr5x-hgm4-rrm6. As a workaround pending patching, avoid executing pymanager from untrusted directories or directories shared with other users, and sanitize the current working directory before running pymanager in automated environments. For Python package managers and build systems, consider running pymanager in isolated environments or with restricted sys.path configurations. The upstream fix removes the insecure inclusion of the current working directory from sys.path or reorders sys.path to prioritize standard library and site-packages over cwd.