CVE-2026-47781 pdm-project CVE debrief

Who should care

Users of PDM, especially those in CI/CD environments, automation scripts, and privileged contexts, should be aware of this vulnerability. Developers and administrators using PDM for project dependency management are also advised to take precautions to prevent code execution.

Technical summary

PDM, a Python package and dependency manager, loads project-local plugins from a .pdm-plugins directory during initialization. This feature allows an attacker-controlled file in an untrusted repository checkout to execute arbitrary Python code before any command is parsed. The execution occurs with the privileges of the user invoking pdm, making the impact strongest in CI, automation, and privileged contexts. The issue is fixed in version 2.27.0. Affected users should prioritize patching to prevent code execution.

Defensive priority

CVE-2026-47781 is rated HIGH with a CVSS score of 8.4. Users should prioritize patching to prevent code execution.

Recommended defensive actions

• Inventory and assess PDM installations for exposure to untrusted repositories.
• Restrict access to .pdm-plugins directories in untrusted projects.
• Update PDM to version 2.27.0 or later.
• Monitor for suspicious activity in CI and automation environments.
• Implement compensating controls to limit code execution risks.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE-2026-47781 issue allows attacker-controlled files in untrusted repositories to execute arbitrary Python code. The problem arises from PDM's automatic loading of project-local plugins from a .pdm-plugins directory during initialization. This execution occurs with the privileges of the user invoking pdm, impacting CI, automation, and privileged contexts the most. The issue is fixed in version 2.27.0.

Official resources