CVE-2026-47781 is a high-severity vulnerability in PDM, a Python package and dependency manager. The vulnerability allows attacker-controlled files in untrusted repositories to execute arbitrary Python code during initialization. This occurs because PDM automatically loads project-local plugins from a .pdm-plugins directory, which can lead to code execution with the privileges of the user invoking pdm. Th [truncated]
The CVE-2026-47764 vulnerability affects the pdm package and dependency manager, specifically versions prior to 2.27.0. This vulnerability is classified as a path traversal issue through the write_to_fs function. The vulnerability allows a malicious wheel with traversal entries to write arbitrary files. The issue has been addressed in version 2.27.0, which incorporates a secure _path_with_destdir() functi [truncated]
The CVE-2026-47763 vulnerability affects the pdm package, a Python package and dependency manager, in versions prior to 2.27.0. This vulnerability class allows a malicious repository to overwrite arbitrary files with the privileges of the invoking user, potentially leading to a denial of service or elevation of privileges. The issue arises from the lack of symlink protection when writing project-local sta [truncated]
