EUVD-2026-17911Severity by source
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
4DescriptionCVE.org
pymanager included the current working directory in sys.path meaning modules could be shadowed by modules in the current working directory. This could lead to modules getting shadowed
Articles & Coverage 1
AnalysisAI
pymanager allows local attackers to shadow legitimate Python modules by placing malicious modules in the current working directory, leading to arbitrary code execution when the application imports standard library or third-party modules. The vulnerability affects pymanager due to insecure sys.path manipulation that includes the current working directory with high priority, enabling privilege escalation or information disclosure depending on the affected module and execution context. No public exploit code has been identified, but the local attack vector with low complexity makes this a practical risk in shared or untrusted execution environments.
Technical ContextAI
pymanager is a Python package management and execution tool that manipulates Python's module search path (sys.path) during initialization. The vulnerability stems from insecure handling of sys.path, where the current working directory is included early in the module resolution order, violating the principle of least privilege for module loading. This is a classic Python path injection vulnerability (related to CWE-426: Untrusted Search Path and CWE-427: Uncontrolled Search Path Element). When Python's import system searches for modules, it traverses sys.path in order; by placing a malicious module with the same name as a legitimate module in the current directory, an attacker can intercept and shadow the intended import. The CVE references GHSA-jr5x-hgm4-rrm6, indicating this was disclosed through GitHub's security advisory system.
RemediationAI
Users must update pymanager to a patched version released by the Python project. Patch availability and exact version numbers should be confirmed via the official GitHub security advisory at https://github.com/python/pymanager/security/advisories/GHSA-jr5x-hgm4-rrm6. As a workaround pending patching, avoid executing pymanager from untrusted directories or directories shared with other users, and sanitize the current working directory before running pymanager in automated environments. For Python package managers and build systems, consider running pymanager in isolated environments or with restricted sys.path configurations. The upstream fix removes the insecure inclusion of the current working directory from sys.path or reorders sys.path to prioritize standard library and site-packages over cwd.
Same weakness CWE-427 – Uncontrolled Search Path Element
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today