PyPI/pdm CVE-2023-45805: high 7.8, EPSS 0.45%
PDM Trojan Lockfile
Action: Upgrade pdm to 2.10.0 or later.
pip install pdm==2.10.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 2.10.0 | - |
Fixed versions
| 2.10.0 |
Sources
- osv: PYSEC-2026-1763
- https://github.com/pdm-project/pdm/security/advisories/GHSA-j44v-mmf2-xvm9
- https://nvd.nist.gov/vuln/detail/CVE-2023-45805
- https://github.com/pdm-project/pdm/commit/6853e2642dfa281d4a9958fbc6c95b7e32d84831
- https://github.com/frostming/unearth/blob/eca170d9370ac5032f2e497ee9b1b63823d3fe0f/src/unearth/evaluator.py#L215-L229
- https://github.com/pdm-project/pdm
- https://github.com/pdm-project/pdm/blob/45d1dfa47d4900c14a31b9bb761e4c46eb5c9442/src/pdm/models/candidates.py#L98-L99
- https://peps.python.org/pep-0440/#post-release-spelling
- https://pypi.org/project/pdm
- https://github.com/advisories/GHSA-j44v-mmf2-xvm9
CVE-2023-45805 · published · modified · JSON