In versions up to and including 2.26.9, PDM automatically loads project-local plugins from a .pdm-plugins directory during initialization, allowing… (CVE-2026-47781)

PDM, a Python package and dependency manager, in versions up to and including 2.26.9, has a vulnerability where it automatically loads project-local plugins from a .pdm-plugins directory during initialization. This loading mechanism uses site.addsitedir(), which processes .pth files and executes any import statements found, leading to arbitrary Python code execution if an attacker controls files in the .pdm-plugins directory of an untrusted repository checkout. This code runs with the privileges of the user invoking PDM and is triggered even by simple commands such as 'pdm --version'. The vulnerability is resolved in version 2.27.0.

An attacker who can place files in the .pdm-plugins directory of a project can execute arbitrary Python code with the privileges of the user running PDM. This can lead to unauthorized code execution in local or automated environments, especially impacting continuous integration (CI) systems or privileged contexts. The vulnerability is triggered during initialization before any command parsing, increasing the risk of exploitation.

Upgrade PDM to version 2.27.0 or later, where this vulnerability is fixed. Until then, avoid running PDM commands in untrusted repository checkouts that may contain malicious .pdm-plugins directories. There is no indication that other mitigations or workarounds are provided by the vendor.