Pdm-project vulnerabilities
We track 3 vulnerabilities in Pdm-project products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on August 4, 2026.
Latest Pdm-project vulnerabilities
- 8.4 High severity
pdm: Improper Control of Generation of Code
PDM is a Python package and dependency manager. In versions up to and including 2.26.9, PDM automatically loads project-local plugins from a .pdm-plugins directory during initialization, allowing an attacker-controlled file in an untrusted repository checkout
- 8.4 High severity
pdm: Improper Limitation of a Pathname to a Restricted Directory
pdm is a Python package and dependency manager supporting the latest PEP standards. Versions prior to 2.27.0 are vulnerable to path traversal through write_to_fs. InstallDestination.write_to_fs() in src/pdm/installers/installers.py overrides the base class to
- 7.8 High severity
pdm is a Python package and dependency manager supporting the latest PEP standards.
pdm is a Python package and dependency manager supporting the latest PEP standards. It's possible to craft a malicious `pdm.lock` file that could allow e.g. an insider or a malicious open source project to appear to depend on a trusted PyPI project, but actual