CVE-2026-5271

CVE-2026-5271 is a search path hijacking vulnerability in pymanager, where the application includes the current working directory in its module search path. This allows a malicious module in an attacker-controlled directory to be imported and executed instead of the intended package if a user runs a pymanager-generated command from that location. Rated with a CVSSv4 score of 5.6 Medium, this vulnerability requires local access and user interaction to exploit, with low attack complexity, potentially leading to high integrity impact through arbitrary code execution. There is currently no evidence of active exploitation, nor are public exploit codes available in common repositories, and community discussion and media coverage are minimal.