PyPI/pdm CVE-2026-47781: high 8.4, EPSS 0.19%

PDM: Project-Controlled `.pdm-plugins` Content Executes Before CLI Parsing

Action: Upgrade pdm to 2.27.0 or later.

pip install pdm==2.27.0

Affected

Fixed versions

Sources

• osv: GHSA-qq6c-99pv-prvf
• nvd: CVE-2026-47781
• https://github.com/pdm-project/pdm/security/advisories/GHSA-qq6c-99pv-prvf
• https://github.com/pdm-project/pdm
• https://github.com/pdm-project/pdm/releases/tag/2.27.0

CVE-2026-47781 · published 2026-06-11T13:25:28Z · modified 2026-07-13T16:42:59.452875804Z · JSON