# pdm (PyPI) vulnerabilities 4 known vulnerabilities (3 high, 1 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 2.29.7 (Nov 6, 2026): no advisory affects it - Newest unaffected release: 2.29.7 (Nov 6, 2026), the latest release - Weekly downloads: 360.6K - Dependents: 43 - Releases: 260 since 0.0.0 (Apr 12, 2021) - Registry: https://pypi.org/project/pdm/ - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-47781: 0.0.0 to 2.26.9 (2.27.0 is outside it) - CVE-2026-47764: 0.0.0 to 2.26.9 (2.27.0 is outside it) - CVE-2026-47763: 0.0.0 to 2.26.9 (2.27.0 is outside it) - CVE-2023-45805: 0.0.0 to 2.9.3 (2.10.0 is outside it) ## Advisories (4) ### [CVE-2026-47781](https://cve.now/CVE-2026-47781): pdm: Project-Controlled \`.pdm-plugins\` Content Executes Before CLI Parsing - Severity: High 8.4 - Published: Aug 4, 2026 - Affected: fixed in 2.27.0. - Fixed in 2.27.0 (released May 21, 2026, 75 days before disclosure). - The latest release, 2.29.7, is not affected. ### [CVE-2026-47764](https://cve.now/CVE-2026-47764): pdm: Path traversal in wheel installation via overridden write\_to\_fs - Severity: High 8.4 - Published: Aug 4, 2026 - Affected: fixed in 2.27.0. - Fixed in 2.27.0 (released May 21, 2026, 75 days before disclosure). - The latest release, 2.29.7, is not affected. ### [CVE-2026-47763](https://cve.now/CVE-2026-47763): pdm: Project-Local State and Config Writes Follow Symlinks - Severity: Medium 6.8 - Published: Aug 4, 2026 - Affected: fixed in 2.27.0. - Fixed in 2.27.0 (released May 21, 2026, 75 days before disclosure). - The latest release, 2.29.7, is not affected. ### [CVE-2023-45805](https://cve.now/CVE-2023-45805): Trojan Lockfilein pdm - Severity: High 7.8 - Published: Oct 20, 2023 - Affected: fixed in 2.10.0; through 2.9.3. - Fixed in 2.10.0 (released Oct 26, 2023, 6 days after disclosure). - The latest release, 2.29.7, is not affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/pypi/pdm Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.