CVE-2026-47781

Name of the Vulnerable Software and Affected Versions PDM versions prior to 2.28.0

Description PDM automatically loads project-local plugin paths from .pdm-plugins during Core initialization. This process uses site.addsitedir(), which on CPython processes .pth files in the added directory. If a .pth file contains lines beginning with import , that code is executed immediately. This allows an attacker to achieve arbitrary code execution with the privileges of the user running pdm when the user executes any command, such as pdm --version, from an untrusted repository checkout. The issue is particularly critical in CI environments, privileged shells, and automation contexts, potentially leading to credential theft, persistence, or privilege escalation if run via sudo or root-owned accounts.

Recommendations Update to version 2.28.0 or later. As a temporary workaround, avoid running pdm commands within untrusted repository checkouts. Restrict the use of project-local .pdm-plugins by ensuring they are not auto-loaded by default.