CVE-2026-47781

Received Received - Intake

Arbitrary Code Execution in PDM Dependency Manager

Publication date: 2026-08-04

Last updated on: 2026-08-05

Assigner: GitHub, Inc.

Description

PDM is a Python package and dependency manager. In versions up to and including 2.26.9, PDM automatically loads project-local plugins from a .pdm-plugins directory during initialization, allowing an attacker-controlled file in an untrusted repository checkout to execute arbitrary Python code before any command is parsed. This happens because load_plugins() runs during Core.init() and adds .pdm-plugins via site.addsitedir(), which processes .pth files and immediately executes any line beginning with import, so the code runs with the privileges of the user invoking pdm and even a benign command such as pdm --version triggers it (making the impact strongest in CI, automation, and privileged contexts). The issue is fixed in version 2.27.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-04

Last Modified

2026-08-05

Generated

2026-08-25

AI Q&A

2026-08-04

EPSS Evaluated

2026-08-23

NVD

CVE-2026-47781

EUVD

EUVD-2026-52867

Affected Vendors & Products

Vendor	Product	Version / Range
pdm	pdm	to 2.26.9 (inc)
pdm	pdm	2.27.0
pdm_project	pdm	to 2.26.9 (inc)
pdm_project	pdm	2.27.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-94	The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
CWE-829	The product imports, requires, or includes executable functionality (such as a library) from a source that is outside of the intended control sphere.

Attack-Flow Graph

Executive Summary

PDM versions up to 2.26.9 automatically load project-local plugins from a .pdm-plugins directory during initialization. This allows an attacker to place a malicious file in an untrusted repository that executes arbitrary Python code before any PDM command is processed. The code runs with the privileges of the user invoking PDM, even for simple commands like pdm --version.

Detection Guidance

Check for the presence of a .pdm-plugins directory in PDM project directories. Review any .pth files in that directory for suspicious import statements. Commands like find /path/to/project -name '.pdm-plugins' -type d or grep -r 'import' /path/to/project/.pdm-plugins/ may help identify potential exploitation attempts.

Impact Analysis

An attacker could execute arbitrary code with your user privileges, leading to credential theft, persistence in your system, tampering with your workspace, or privilege escalation if PDM runs with elevated permissions. This is especially dangerous in CI environments, automation, and privileged contexts where PDM is commonly used.

Compliance Impact

This vulnerability could lead to unauthorized code execution, potentially compromising data integrity and confidentiality. For GDPR, it may result in unauthorized access to personal data, violating principles of data protection by design. For HIPAA, it could allow unauthorized access to protected health information, breaching security requirements for electronic protected health information.

Mitigation Strategies

Upgrade PDM to version 2.27.0 or later immediately. Avoid running PDM in untrusted directories or CI environments until updated. Disable auto-loading of project-local plugins if possible by reviewing PDM configuration files.

Hi! I’m here to help you understand CVE-2026-47781. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70