Security update for pyenv

CVE-2026-68939 is a vulnerability in pyenv where a matching attacker-controlled file can silently influence pyenv to select a different installed interpreter or version than intended. This could allow an attacker to manipulate which interpreter is executed without alerting the user. The issue was identified and fixed by the SUSE Product Security Team. The affected versions are specific SUSE pyenv package versions, including 2.5.4-1build1, 2.6.8-1, and pyenv-2.4.14-bp160.2.1.aarch64 among others. No known exploits are reported in the wild.

An attacker able to place a matching file could cause pyenv to select an unintended interpreter or version silently. This may lead to execution of malicious code or unexpected behavior depending on the interpreter selected. The impact is rated medium, reflecting potential but not critical or widespread exploitation.

The vendor has released updates fixing this issue in the specified SUSE pyenv package versions. Users should apply these updates to remediate the vulnerability. Since no exploit is known in the wild, applying the official fixes is the recommended action. Patch status is not explicitly confirmed beyond the update notice; users should consult the SUSE Product Security Team advisories for the latest remediation guidance.