CVE-2026-47781

PDM is a Python package and dependency manager. In versions up to and including 2.26.9, PDM automatically loads project-local plugins from a .pdm-plugins directory during initialization, allowing an attacker-controlled file in an untrusted repository checkout to execute arbitrary Python code befo...

CVE-2026-47763

pdm is a Python package and dependency manager supporting the latest PEP standards. In versions prior to 2.27.0, pdm writes several project-local state or configuration files without symlink protection. If a malicious repository places those files as symlinks, local PDM operations can overwrite t...

CVE-2026-47763 pdm: Project-Local State and Config Writes Follow Symlinks

pdm is a Python package and dependency manager supporting the latest PEP standards. In versions prior to 2.27.0, pdm writes several project-local state or configuration files without symlink protection. If a malicious repository places those files as symlinks, local PDM operations can overwrite t...

EUVD-2026-52807

pdm is a Python package and dependency manager supporting the latest PEP standards. In versions prior to 2.27.0, pdm writes several project-local state or configuration files without symlink protection. If a malicious repository places those files as symlinks, local PDM operations can overwrite t...

doppler-pdm (>=0.1.0 <=1.0.2), liteyukibot-plugin-nonebot (>=0.1.0 <=0.1.3) +9 more potentially affected by CVE-2026-47763 via pdm (>=1.15.5 <=2.26.2)

pdm PYPI version =1.15.5, =0.1.0, =0.1.0, =0.1.5, =0.14.0, =0.2.0, =0.8.0, =0.8.0b1, =0.8.0b2 Source cves: CVE-2026-47763 Source advisory: OSV:GHSA-GHQ2-5C67-FPRM...

SUSE CVE-2023-45805

pdm is a Python package and dependency manager supporting the latest PEP standards. It's possible to craft a malicious pdm.lock file that could allow e.g. an insider or a malicious open source project to appear to depend on a trusted PyPI project, but actually install another project. A project f...