CVE-2026-47781
HighCVSS 8.4Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
PDM is a Python package and dependency manager. In versions up to and including 2.26.9, PDM automatically loads project-local plugins from a .pdm-plugins directory during initialization, allowing an attacker-controlled file in an untrusted repository checkout to execute arbitrary Python code before any command is parsed. This happens because load_plugins() runs during Core.init() and adds .pdm-plugins via site.addsitedir(), which processes .pth files and immediately executes any line beginning with import, so the code runs with the privileges of the user invoking pdm and even a benign command such as pdm --version triggers it (making the impact strongest in CI, automation, and privileged contexts).
Risk Assessment
The risk is arbitrary code execution in the context of the user running pdm, which in CI or privileged environments could lead to full system compromise.
Recommendation
It is recommended to upgrade PDM to version 2.27.0 or higher, which includes a fix that prevents automatic loading of plugins from untrusted sources.
Other vulnerabilities in PDM
See all- CVE-2026-47764High
pdm is a Python package and dependency manager. Versions prior to 2.27.0 are vulnerable to path traversal through write_to_fs. InstallDestination.write_to_fs() in src/pdm/installers/installers.py overrides the base class to add symlink/hardlink support but replaces the safe _path_with_destdir() (which validates via Path.resolve() + is_relative_to()) with a bare os.path.join() that performs no path validation. A malicious wheel with traversal entries can write arbitrary files.
- CVE-2026-47763Medium
pdm, a Python package and dependency manager, prior to version 2.27.0 writes several project-local state or configuration files without symlink protection. A malicious repository can place those files as symlinks, and local PDM operations can overwrite the symlink targets, creating an arbitrary file clobber primitive relative to the invoking user's privileges.
Original NVD description (English source)
PDM is a Python package and dependency manager. In versions up to and including 2.26.9, PDM automatically loads project-local plugins from a .pdm-plugins directory during initialization, allowing an attacker-controlled file in an untrusted repository checkout to execute arbitrary Python code before any command is parsed. This happens because load_plugins() runs during Core.init() and adds .pdm-plugins via site.addsitedir(), which processes .pth files and immediately executes any line beginning with import, so the code runs with the privileges of the user invoking pdm and even a benign command such as pdm --version triggers it (making the impact strongest in CI, automation, and privileged contexts). The issue is fixed in version 2.27.0.