{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"2.9.3"}],"component":"pdm","cve_ids":["CVE-2023-45805"],"ecosystem":"PyPI","epss":0.00452,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-j44v-mmf2-xvm9","id":"tcs_01M5KFN0D8SRQKERBEV3YT75XJ","modified_at":"2026-07-07T17:56:08.955520436Z","published_at":"2023-10-20T19:30:23Z","references":["https://osv.dev/vulnerability/GHSA-j44v-mmf2-xvm9","https://github.com/pdm-project/pdm/security/advisories/GHSA-j44v-mmf2-xvm9","https://nvd.nist.gov/vuln/detail/CVE-2023-45805","https://github.com/pdm-project/pdm/commit/6853e2642dfa281d4a9958fbc6c95b7e32d84831","https://github.com/frostming/unearth/blob/eca170d9370ac5032f2e497ee9b1b63823d3fe0f/src/unearth/evaluator.py#L215-L229","https://github.com/pdm-project/pdm","https://github.com/pdm-project/pdm/blob/45d1dfa47d4900c14a31b9bb761e4c46eb5c9442/src/pdm/models/candidates.py#L98-L99","https://peps.python.org/pep-0440/#post-release-spelling"],"severity":{"label":"high","score":7.8},"sources":[{"source":"osv","source_id":"GHSA-j44v-mmf2-xvm9","url":"https://osv.dev/vulnerability/GHSA-j44v-mmf2-xvm9"}],"summary":"PDM Trojan Lockfile"}