rpm package
opensuse/python-pdm&distro=openSUSE Tumbleweed
pkg:rpm/opensuse/python-pdm&distro=openSUSE%20Tumbleweed
Vulnerabilities (3)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2026-47781 | hig | — | < 2.28.0-1.1 | 2.28.0-1.1 | Jun 11, 2026 | ## Summary PDM automatically loads project-local plugin paths from `.pdm-plugins` during `Core` initialization. Because this path is added via `site.addsitedir()`, attacker-controlled `.pth` files inside the project plugin directory are processed and can execute Python code befo | |
| CVE-2026-47764 | hig | — | < 2.28.0-1.1 | 2.28.0-1.1 | Jun 10, 2026 | InstallDestination.write_to_fs() in src/pdm/installers/installers.py overrides the base class to add symlink/hardlink support but replaces the safe _path_with_destdir() (which validates via Path.resolve() + is_relative_to()) with a bare os.path.join() that performs no path valida | |
| CVE-2026-47763 | — | < 2.28.0-1.1 | 2.28.0-1.1 | Jun 10, 2026 | ## Summary PDM writes several project-local state or configuration files without symlink protection. If a malicious repository places those files as symlinks, local PDM operations can overwrite the symlink targets. This creates an arbitrary file clobber primitive relative to th |
- affected < 2.28.0-1.1fixed 2.28.0-1.1
## Summary PDM automatically loads project-local plugin paths from `.pdm-plugins` during `Core` initialization. Because this path is added via `site.addsitedir()`, attacker-controlled `.pth` files inside the project plugin directory are processed and can execute Python code befo
- affected < 2.28.0-1.1fixed 2.28.0-1.1
InstallDestination.write_to_fs() in src/pdm/installers/installers.py overrides the base class to add symlink/hardlink support but replaces the safe _path_with_destdir() (which validates via Path.resolve() + is_relative_to()) with a bare os.path.join() that performs no path valida
- CVE-2026-47763Jun 10, 2026affected < 2.28.0-1.1fixed 2.28.0-1.1
## Summary PDM writes several project-local state or configuration files without symlink protection. If a malicious repository places those files as symlinks, local PDM operations can overwrite the symlink targets. This creates an arbitrary file clobber primitive relative to th