PYSEC-2026-1763 PDM Trojan Lockfile

Summary It's possible to craft a malicious pdm.lock file that could allow e.g. an insider or a malicious open source project to appear to depend on a trusted PyPI project, but actually install another project. Details Project foo can be targeted by creating the project foo-2 and uploading the fil...

DEBIAN-CVE-2023-45805

pdm is a Python package and dependency manager supporting the latest PEP standards. It's possible to craft a malicious pdm.lock file that could allow e.g. an insider or a malicious open source project to appear to depend on a trusted PyPI project, but actually install another project. A project f...

PT-2023-29697

Name of the Vulnerable Software and Affected Versions pdm versions prior to 2.9.4 Description It's possible to craft a malicious pdm.lock file that could allow an insider or a malicious open source project to appear to depend on a trusted PyPI project, but actually install another project. A...