pymanager included the current working directory in sys.path meaning modules could be shadowed by modules in the current working directory. As a result, if a user executes a pymanager-generated command (e.g., pip, pytest) from an attacker-controlled directory, a malicious module in that directory can be imported and executed instead of the intended package.

-------- Forwarded Message -------- Date: Wed, 1 Apr 2026 18:07:40 +0100 From: Steve Dower <steve.dower () python org> Reply-To: security-sig () python org To: security-announce () python org

There is a MEDIUM severity vulnerability affecting the Python install manager. Version 26.1 is fixed. Versions prior to 26.0 are not impacted. Please see the linked CVE ID for the latest information on affected versions:

https://www.cve.org/CVERecord?id=CVE-2026-5271 https://github.com/python/pymanager/pull/301 Security-announce mailing list -- security-announce () python org To unsubscribe send an email to security-announce-leave () python org https://mail.python.org/mailman3//lists/security-announce.python.org