PT-2023-29697

Name of the Vulnerable Software and Affected Versions pdm versions prior to 2.9.4 Description It's possible to craft a malicious pdm.lock file that could allow an insider or a malicious open source project to appear to depend on a trusted PyPI project, but actually install another project. A...