CVE-2026-47763

Name of the Vulnerable Software and Affected Versions PDM versions prior to 2.28.0-1.1

Description PDM writes project-local state and configuration files without symlink protection, allowing a malicious repository to use symlinks to overwrite files outside the repository root. This creates an arbitrary file clobber primitive based on the privileges of the user running the command. The issue occurs because project-local file sinks are treated as trusted regular files and are written without symlink checks or guarded atomic replacement.

Technical details include:

For the pdm.toml file to be overwritten, the target file must already contain parseable TOML data; otherwise, the process fails during the load step. This constraint does not apply to .pdm-python or .python-version files.

Recommendations Update PDM to version 2.28.0-1.1 or later. As a temporary mitigation, avoid running PDM commands within repositories from untrusted sources. Restrict the use of the pdm config -l command in environments with elevated privileges until the update is applied.