PyPI/pdm CVE-2026-47781: unknown, EPSS 0.19%

PDM: Project-Controlled `.pdm-plugins` Content Executes Before CLI Parsing

Action: Upgrade pdm to 2.27.0 or later.

pip install pdm==2.27.0

Affected

Fixed versions

Sources

• osv: PYSEC-2026-2863
• https://github.com/pdm-project/pdm/security/advisories/GHSA-qq6c-99pv-prvf
• https://github.com/pdm-project/pdm
• https://github.com/pdm-project/pdm/releases/tag/2.27.0
• https://pypi.org/project/pdm
• https://github.com/advisories/GHSA-qq6c-99pv-prvf
• https://nvd.nist.gov/vuln/detail/CVE-2026-47781

CVE-2026-47781 · published 2026-07-13T15:46:16.159273Z · modified 2026-07-13T16:32:55.809295075Z · JSON