pdm-project vulnerabilities and threats

pdm is a Python package and dependency manager supporting the latest PEP standards. Versions prior to 2.27.0 are vulnerable to path traversal through write_to_fs. InstallDestination.write_to_fs() in src/pdm/installers/installers.py overrides the base class to add symlink/hardlink support but replaces the safe _path_with_destdir() (which validates via Path.resolve() + is_relative_to()) with a bare os.path.join() that performs no path validation. A malicious wheel with traversal entries can write arbitrary files. This issue has been fixed in version 2.27.0.

PDM, a Python package and dependency manager, versions up to and including 2.26.9 automatically load project-local plugins from a .pdm-plugins directory during initialization. This behavior allows an attacker-controlled file in an untrusted repository checkout to execute arbitrary Python code before any command is parsed. The vulnerability arises because the load_plugins() function runs during Core.init() and adds .pdm-plugins via site.addsitedir(), which processes .pth files and executes import lines immediately. This code execution occurs with the privileges of the user running pdm, affecting even benign commands like pdm --version. The issue is fixed in version 2.27.0.

CVE-2026-47763 is a medium severity vulnerability in the Python package manager pdm prior to version 2.27.0. It allows an attacker to exploit symbolic link (symlink) following when pdm writes project-local state or configuration files without symlink protection. This can lead to arbitrary file overwrite relative to the privileges of the user running pdm. The issue affects files such as pdm.toml, .pdm-python, and .python-version. The vulnerability has been fixed in pdm version 2.27.0.