Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
3 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
PDM automatically loads project-local plugin paths from .pdm-plugins during Core initialization. Because this path is added via site.addsitedir(), attacker-controlled .pth files inside the project plugin directory are processed and can execute Python code before normal CLI handling begins. This allows arbitrary code execution with the privileges of the user running pdm from an untrusted repository checkout. Affected Behavior - Trigger does not require pdm install --plugins - A low-impact command such as pdm --version is sufficient - Impact is strongest in CI, privileged shells, and automation contexts Affected Code - src/pdm/core.py:74-82 - src/pdm/core.py:310-333 - src/pdm/core.py:335-352 Technical Details Core.init() calls loadplugins() before ordinary command execution. loadplugins() calls addprojectpluginslibrary(), which derives the project-local .pdm-plugins library path and adds it through site.addsitedir(). On CPython, site.addsitedir() processes .pth files found in…
Recommended action: Upgrade to 2.27.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
InstallDestination.writetofs() in src/pdm/installers/installers.py overrides the base class to add symlink/hardlink support but replaces the safe pathwithdestdir() (which validates via Path.resolve() + isrelativeto()) with a bare os.path.join() that performs no path validation. A malicious wheel with traversal entries can write arbitrary files. Same class as Poetry CVE-2026-34591. Fix ready at: https://github.com/pdm-project/pdm/pull/3787.
Recommended action: Upgrade to 2.27.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
PDM writes several project-local state or configuration files without symlink protection. If a malicious repository places those files as symlinks, local PDM operations can overwrite the symlink targets. This creates an arbitrary file clobber primitive relative to the privileges of the invoking user. Affected Behavior - Project-local config writes can affect files outside the repository - The most stable demonstrated sink is pdm.toml - Related sinks include .pdm-python and .python-version Affected Code - src/pdm/project/config.py:303-350 - src/pdm/project/core.py:209-217 - src/pdm/cli/commands/use.py:187-189 Technical Details Config.init() resolves the project-local pdm.toml path and saveconfig() writes to the resolved target. If PROJECTROOT/pdm.toml is a symlink to another file, pdm config -l ... updates the target file instead of refusing the write. The same general problem exists for other project-local persistence paths that are written directly with no lstat / ONOFOLLOW…
Recommended action: Upgrade to 2.27.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.