These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
CVE-2026-47781 is a high-severity vulnerability in the PDM Python package and dependency manager. Versions up to and including 2.26.9 are affected. An attacker-controlled file in an untrusted repository can execute arbitrary Python code during PDM initialization, allowing for potential code execution with the privileges of the user invoking PDM. The issue is fixed in version 2.27.0.
A vulnerability in the pdm Python package and dependency manager allows for path traversal through the write_to_fs function, enabling malicious wheels to write arbitrary files. This issue was fixed in version 2.27.0. The vulnerability exists due to improper path validation in the InstallDestination.write_to_fs() function, which can be exploited by a malicious wheel with traversal entries. Defenders should [truncated]
PatchSiren debrief for CVE-2026-47763: PDM project-local file clobber via symlink attack. The vulnerability in PDM versions prior to 2.27.0 allows for arbitrary file clobbering via symlinks, posing a risk to PDM users and maintainers. This issue is resolved in version 2.27.0. Users should assess exposure and apply the fix to prevent potential symlink attacks. The CVE record and NVD entry provide details o [truncated]