CVE-2026-47781 pdm: Project-Controlled `.pdm-plugins` Content Executes Before CLI Parsing

PDM is a Python package and dependency manager. In versions up to and including 2.26.9, PDM automatically loads project-local plugins from a .pdm-plugins directory during initialization, allowing an attacker-controlled file in an untrusted repository checkout to execute arbitrary Python code befo...

CVE-2026-47781 pdm: Project-Controlled `.pdm-plugins` Content Executes Before CLI Parsing

PDM is a Python package and dependency manager. In versions up to and including 2.26.9, PDM automatically loads project-local plugins from a .pdm-plugins directory during initialization, allowing an attacker-controlled file in an untrusted repository checkout to execute arbitrary Python code befo...

CVE-2026-47781

CVE-2026-47781 affects PDM up to v2.26.9, where Core.init() calls load_plugins() and adds the project-local .pdm-plugins via site.addsitedir(). This causes .pth files to be processed, allowing attacker-controlled content in an untrusted repository checkout to execute arbitrary Python code before ...

CVE-2026-47781 pdm: Project-Controlled `.pdm-plugins` Content Executes Before CLI Parsing

PDM is a Python package and dependency manager. In versions up to and including 2.26.9, PDM automatically loads project-local plugins from a .pdm-plugins directory during initialization, allowing an attacker-controlled file in an untrusted repository checkout to execute arbitrary Python code befo...

django-rstblog (>=0.1.0, <=0.1.1), drf-user (0.0.1) +2 more potentially affected by CVE-2026-15307 via django (2.0.7)

django PYPI version 2.0.7 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - django-rstblog =0.1.0, =0.1.1 - drf-user 0.0.1 - drfaddons 0.0.3 - umap-project 1.0.0rc1 Source cves: CVE-2026-15307 Source advisory:...

django-rstblog (>=0.1.0, <=0.1.1), drf-user (0.0.1) +2 more potentially affected by CVE-2026-15830 via django (2.0.7)

django PYPI version 2.0.7 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - django-rstblog =0.1.0, =0.1.1 - drf-user 0.0.1 - drfaddons 0.0.3 - umap-project 1.0.0rc1 Source cves: CVE-2026-15830 Source advisory:...

seed-auth-api (>=0.9.0, <=0.9.2), umap-project (>=0.8.0, <=0.8.3) potentially affected by CVE-2026-15307 via django (1.10.5)

django PYPI version 1.10.5 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - seed-auth-api =0.9.0, =0.8.0, =0.8.3 Source cves: CVE-2026-15307 Source advisory: OSV:GHSA-WVQV-FJ8W-QMHM...

django-rest-authemail (>=1.7.9, <=2.0.0), umap-project (>=1.0.0rc2, <=1.0.0rc6) +1 more potentially affected by CVE-2026-15307 via django (2.1.1)

django PYPI version 2.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - django-rest-authemail =1.7.9, =1.0.0rc2, =0.1.0, =0.2.0.dev2 Source cves: CVE-2026-15307 Source advisory: OSV:GHSA-WVQV-FJ8W-QMHM...

caluma (>=5.4.0, <=5.5.2), django-cms-forms (>=0.0.1, <=0.0.11) +2 more potentially affected by CVE-2026-15307 via django (2.2.11)

django PYPI version 2.2.11 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - caluma =5.4.0, =0.0.1, =0.3.10.56, =1.2.0, =1.2.2 Source cves: CVE-2026-15307 Source advisory: OSV:GHSA-WVQV-FJ8W-QMHM...

django-alexa (0.0.9), katka-core (>=0.5.0, <=0.8.0) +2 more potentially affected by CVE-2026-15307 via django (2.1.5)

django PYPI version 2.1.5 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - django-alexa 0.0.9 - katka-core =0.5.0, =1.0.0rc9, =1.0.0 Source cves: CVE-2026-15307 Source advisory: OSV:GHSA-WVQV-FJ8W-QMHM...

django-rest-authemail (>=1.7.9, <=2.0.0), umap-project (>=1.0.0rc2, <=1.0.0rc6) +1 more potentially affected by CVE-2026-15830 via django (2.1.1)

django PYPI version 2.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - django-rest-authemail =1.7.9, =1.0.0rc2, =0.1.0, =0.2.0.dev2 Source cves: CVE-2026-15830 Source advisory: OSV:GHSA-Q238-5CXM-5C9H...

CVE-2026-47763

pdm is a Python package and dependency manager supporting the latest PEP standards. In versions prior to 2.27.0, pdm writes several project-local state or configuration files without symlink protection. If a malicious repository places those files as symlinks, local PDM operations can overwrite t...

UBUNTU-CVE-2026-47763

pdm is a Python package and dependency manager supporting the latest PEP standards. In versions prior to 2.27.0, pdm writes several project-local state or configuration files without symlink protection. If a malicious repository places those files as symlinks, local PDM operations can overwrite t...

CVE-2026-47763 pdm: Project-Local State and Config Writes Follow Symlinks

pdm is a Python package and dependency manager supporting the latest PEP standards. In versions prior to 2.27.0, pdm writes several project-local state or configuration files without symlink protection. If a malicious repository places those files as symlinks, local PDM operations can overwrite t...

CVE-2026-47763

pdm is a Python package and dependency manager supporting the latest PEP standards. In versions prior to 2.27.0, pdm writes several project-local state or configuration files without symlink protection. If a malicious repository places those files as symlinks, local PDM operations can overwrite t...

CVE-2026-47763 pdm: Project-Local State and Config Writes Follow Symlinks

pdm is a Python package and dependency manager supporting the latest PEP standards. In versions prior to 2.27.0, pdm writes several project-local state or configuration files without symlink protection. If a malicious repository places those files as symlinks, local PDM operations can overwrite t...

EUVD-2026-52807

pdm is a Python package and dependency manager supporting the latest PEP standards. In versions prior to 2.27.0, pdm writes several project-local state or configuration files without symlink protection. If a malicious repository places those files as symlinks, local PDM operations can overwrite t...

CVE-2026-47763 pdm: Project-Local State and Config Writes Follow Symlinks

pdm is a Python package and dependency manager supporting the latest PEP standards. In versions prior to 2.27.0, pdm writes several project-local state or configuration files without symlink protection. If a malicious repository places those files as symlinks, local PDM operations can overwrite t...

CVE-2026-47763

CVE-2026-47763 affects the Python package manager pdm . In versions prior to 2.27.0, pdm writes several project-local state/config files without symlink protection. If a malicious repository places those files as symlinks, local PDM operations can overwrite the symlink targets, creating an arbitr...

django-rstblog (>=0.1.0, <=0.1.1), drf-user (0.0.1) +2 more potentially affected by CVE-2026-15830 via django (2.0.7)

django PYPI version 2.0.7 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - django-rstblog =0.1.0, =0.1.1 - drf-user 0.0.1 - drfaddons 0.0.3 - umap-project 1.0.0rc1 Source cves: CVE-2026-15830 Source advisory:...