Threats Tagged 'cve-2026-47781'

PDM, a Python package and dependency manager, versions up to and including 2.26.9 automatically load project-local plugins from a .pdm-plugins directory during initialization. This behavior allows an attacker-controlled file in an untrusted repository checkout to execute arbitrary Python code before any command is parsed. The vulnerability arises because the load_plugins() function runs during Core.init() and adds .pdm-plugins via site.addsitedir(), which processes .pth files and executes import lines immediately. This code execution occurs with the privileges of the user running pdm, affecting even benign commands like pdm --version. The issue is fixed in version 2.27.0.

CVE-2026-47763 is a medium severity vulnerability in the Python package manager pdm prior to version 2.27.0. It allows an attacker to exploit symbolic link (symlink) following when pdm writes project-local state or configuration files without symlink protection. This can lead to arbitrary file overwrite relative to the privileges of the user running pdm. The issue affects files such as pdm.toml, .pdm-python, and .python-version. The vulnerability has been fixed in pdm version 2.27.0.

This security update for python-pdm addresses multiple vulnerabilities including improper handling of symlinks when writing configuration files, writing to unauthorized paths outside the scheme directory, and incorrect plugin installation paths. These issues have been fixed to prevent potential unauthorized file system modifications.