rpm package
opensuse/python-pdm&distro=openSUSE Tumbleweed
pkg:rpm/opensuse/python-pdm&distro=openSUSE%20Tumbleweed
Vulnerabilities (3)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2026-47781 | Hig | — | < 2.28.0-1.1 | 2.28.0-1.1 | Aug 4, 2026 | PDM is a Python package and dependency manager. In versions up to and including 2.26.9, PDM automatically loads project-local plugins from a .pdm-plugins directory during initialization, allowing an attacker-controlled file in an untrusted repository checkout to execute arbitrary | |
| CVE-2026-47764 | Hig | — | < 2.28.0-1.1 | 2.28.0-1.1 | Aug 4, 2026 | pdm is a Python package and dependency manager supporting the latest PEP standards. Versions prior to 2.27.0 are vulnerable to path traversal through write_to_fs. InstallDestination.write_to_fs() in src/pdm/installers/installers.py overrides the base class to add symlink/hardlink | |
| CVE-2026-47763 | Med | — | < 2.28.0-1.1 | 2.28.0-1.1 | Aug 4, 2026 | pdm is a Python package and dependency manager supporting the latest PEP standards. In versions prior to 2.27.0, pdm writes several project-local state or configuration files without symlink protection. If a malicious repository places those files as symlinks, local PDM operation |
- affected < 2.28.0-1.1fixed 2.28.0-1.1
PDM is a Python package and dependency manager. In versions up to and including 2.26.9, PDM automatically loads project-local plugins from a .pdm-plugins directory during initialization, allowing an attacker-controlled file in an untrusted repository checkout to execute arbitrary
- affected < 2.28.0-1.1fixed 2.28.0-1.1
pdm is a Python package and dependency manager supporting the latest PEP standards. Versions prior to 2.27.0 are vulnerable to path traversal through write_to_fs. InstallDestination.write_to_fs() in src/pdm/installers/installers.py overrides the base class to add symlink/hardlink
- affected < 2.28.0-1.1fixed 2.28.0-1.1
pdm is a Python package and dependency manager supporting the latest PEP standards. In versions prior to 2.27.0, pdm writes several project-local state or configuration files without symlink protection. If a malicious repository places those files as symlinks, local PDM operation