CVE-2026-5271

Katalog CVE

CVSS 7.8 · High EPSS 0,19%

Kerentanan Uncontrolled Search Path Element pada python pymanager. Skor CVSS 3.1 7.8 (High) menurut NVD.

Deskripsi (NVD)

pymanager included the current working directory in sys.path meaning modules could be shadowed by modules in the current working directory. As a result, if a user executes a pymanager-generated command (e.g., pip, pytest) from an attacker-controlled directory, a malicious module in that directory can be imported and executed instead of the intended package.

Rincian

Terbit di NVD

1 April 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.8 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-427: Uncontrolled Search Path Element

EPSS (30 hari)

0,19% peluang dieksploitasi; lebih tinggi dari 7,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/python/pymanager/security/advisories/GHSA-jr5x-hgm4-rrm6 exploit · advisory vendor
• http://www.openwall.com/lists/oss-security/2026/04/01/5 mailing list · advisory pihak ketiga