{"action":"Upgrade pdm to 2.10.0 or later.","affected":[{"fixed":"2.10.0","introduced":"0"}],"component":"pdm","cve_ids":["CVE-2023-45805"],"ecosystem":"PyPI","epss":0.00452,"exploited":false,"fixed_versions":["2.10.0"],"ghsa_id":"GHSA-j44v-mmf2-xvm9","id":"tcs_01M5KGVH222R3ABT4H8CPGXPS6","modified_at":"2026-07-07T17:47:17.771927464Z","published_at":"2026-07-07T11:45:25.930514Z","references":["https://osv.dev/vulnerability/PYSEC-2026-1763","https://github.com/pdm-project/pdm/security/advisories/GHSA-j44v-mmf2-xvm9","https://nvd.nist.gov/vuln/detail/CVE-2023-45805","https://github.com/pdm-project/pdm/commit/6853e2642dfa281d4a9958fbc6c95b7e32d84831","https://github.com/frostming/unearth/blob/eca170d9370ac5032f2e497ee9b1b63823d3fe0f/src/unearth/evaluator.py#L215-L229","https://github.com/pdm-project/pdm","https://github.com/pdm-project/pdm/blob/45d1dfa47d4900c14a31b9bb761e4c46eb5c9442/src/pdm/models/candidates.py#L98-L99","https://peps.python.org/pep-0440/#post-release-spelling","https://pypi.org/project/pdm","https://github.com/advisories/GHSA-j44v-mmf2-xvm9"],"severity":{"label":"high","score":7.8},"sources":[{"source":"osv","source_id":"PYSEC-2026-1763","url":"https://osv.dev/vulnerability/PYSEC-2026-1763"}],"summary":"PDM Trojan Lockfile"}