- Latest release
- 2.29.7 (Nov 6, 2026): no advisory affects it
- Newest unaffected release
- 2.29.7 (Nov 6, 2026), the latest release
- Advisories
- 4 · 3 high, 1 medium
- Weekly downloads
- 360.6K
- Dependents
- 43
- Releases
- 260 since 0.0.0 (Apr 12, 2021)
- Registry
- PyPI
- Releases read
- Nov 8, 2026
Version timeline
- CVE-2026-47781Affects 0.0.0 to 2.26.9 (2.27.0 is outside it)
- CVE-2026-47764Affects 0.0.0 to 2.26.9 (2.27.0 is outside it)
- CVE-2026-47763Affects 0.0.0 to 2.26.9 (2.27.0 is outside it)
- CVE-2023-45805Affects 0.0.0 to 2.9.3 (2.10.0 is outside it)
Advisories 4
- CVE-2026-47781High 8.4
pdm: Project-Controlled `.pdm-plugins` Content Executes Before CLI Parsing
Affected: fixed in 2.27.0.
Fixed in 2.27.0 (released May 21, 2026, 75 days before disclosure).
The latest release, 2.29.7, is not affected.
- CVE-2026-47764High 8.4
pdm: Path traversal in wheel installation via overridden write_to_fs
Affected: fixed in 2.27.0.
Fixed in 2.27.0 (released May 21, 2026, 75 days before disclosure).
The latest release, 2.29.7, is not affected.
- CVE-2026-47763Medium 6.8
pdm: Project-Local State and Config Writes Follow Symlinks
Affected: fixed in 2.27.0.
Fixed in 2.27.0 (released May 21, 2026, 75 days before disclosure).
The latest release, 2.29.7, is not affected.
- CVE-2023-45805High 7.8
Trojan Lockfilein pdm
Affected: fixed in 2.10.0; through 2.9.3.
Fixed in 2.10.0 (released Oct 26, 2023, 6 days after disclosure).
The latest release, 2.29.7, is not affected.