Description (CNA)
pymanager included the current working directory in sys.path meaning modules could be shadowed by modules in the current working directory. As a result, if a user executes a pymanager-generated command (e.g., pip, pytest) from an attacker-controlled directory, a malicious module in that directory can be imported and executed instead of the intended package.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Python Software Foundation / pymanager | affected 26.0 before 26.1 |
CWE
No CWE identifiers supplied.
References
ADP enrichment
No English description supplied.
No English description supplied.