HIGHPyPI
GHSA-78v8-vpjp-cjqh· CVE-2026-47764, PYSEC-2026-2861PDM wheel installation leads to Path Traversal via overridden write_to_fs
Modified: 7/13/2026
package
PyPI/pdm
pkg:pypi/pdm
MEDIUMPyPI
GHSA-ghq2-5c67-fprm· CVE-2026-47763, PYSEC-2026-2862PDM: Project-Local State and Config Writes Follow Symlinks
Modified: 7/13/2026
HIGH7.8PyPI
GHSA-j44v-mmf2-xvm9· CVE-2023-45805, PYSEC-2026-1763PDM Trojan Lockfile
Modified: 7/7/2026
HIGHPyPI
GHSA-qq6c-99pv-prvf· CVE-2026-47781, PYSEC-2026-2863PDM: Project-Controlled `.pdm-plugins` Content Executes Before CLI Parsing
Modified: 7/13/2026
HIGH7.8PyPI
PYSEC-2026-1763· CVE-2023-45805, GHSA-j44v-mmf2-xvm9PDM Trojan Lockfile
Modified: 7/7/2026
—PyPI
PYSEC-2026-2861· CVE-2026-47764, GHSA-78v8-vpjp-cjqhPDM wheel installation leads to Path Traversal via overridden write_to_fs
Modified: 7/13/2026
—PyPI
PYSEC-2026-2862· CVE-2026-47763, GHSA-ghq2-5c67-fprmPDM: Project-Local State and Config Writes Follow Symlinks
Modified: 7/13/2026
—PyPI
PYSEC-2026-2863· CVE-2026-47781, GHSA-qq6c-99pv-prvfPDM: Project-Controlled `.pdm-plugins` Content Executes Before CLI Parsing
Modified: 7/13/2026