CVE-2026-47781

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-47781", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-19T22:36:16.883Z", "datePublished": "2026-08-04T18:42:23.036Z", "dateUpdated": "2026-08-05T13:48:50.422Z"}, "containers": {"cna": {"title": "pdm: Project-Controlled `.pdm-plugins` Content Executes Before CLI Parsing", "problemTypes": [{"descriptions": [{"cweId": "CWE-829", "lang": "en", "description": "CWE-829: Inclusion of Functionality from Untrusted Control Sphere", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-94", "lang": "en", "description": "CWE-94: Improper Control of Generation of Code ('Code Injection')", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "LOCAL", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "ACTIVE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 8.4, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/pdm-project/pdm/security/advisories/GHSA-qq6c-99pv-prvf", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/pdm-project/pdm/security/advisories/GHSA-qq6c-99pv-prvf"}, {"name": "https://github.com/pdm-project/pdm/releases/tag/2.27.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/pdm-project/pdm/releases/tag/2.27.0"}], "affected": [{"vendor": "pdm-project", "product": "pdm", "versions": [{"version": "< 2.27.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-04T18:42:23.036Z"}, "descriptions": [{"lang": "en", "value": "PDM is a Python package and dependency manager. In versions up to and including 2.26.9, PDM automatically loads project-local plugins from a .pdm-plugins directory during initialization, allowing an attacker-controlled file in an untrusted repository checkout to execute arbitrary Python code before any command is parsed. This happens because load_plugins() runs during Core.init() and adds .pdm-plugins via site.addsitedir(), which processes .pth files and immediately executes any line beginning with import, so the code runs with the privileges of the user invoking pdm and even a benign command such as pdm --version triggers it (making the impact strongest in CI, automation, and privileged contexts). The issue is fixed in version 2.27.0."}], "source": {"advisory": "GHSA-qq6c-99pv-prvf", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/pdm-project/pdm/security/advisories/GHSA-qq6c-99pv-prvf", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-05T13:48:06.311095Z", "id": "CVE-2026-47781", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-05T13:48:50.422Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-47781", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-08-05T13:48:06.311095Z"}}}], "references": [{"url": "https://github.com/pdm-project/pdm/security/advisories/GHSA-qq6c-99pv-prvf", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-05T13:48:26.590Z"}}], "cna": {"title": "pdm: Project-Controlled `.pdm-plugins` Content Executes Before CLI Parsing", "source": {"advisory": "GHSA-qq6c-99pv-prvf", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 8.4, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH"}}], "affected": [{"vendor": "pdm-project", "product": "pdm", "versions": [{"status": "affected", "version": "< 2.27.0"}]}], "references": [{"url": "https://github.com/pdm-project/pdm/security/advisories/GHSA-qq6c-99pv-prvf", "name": "https://github.com/pdm-project/pdm/security/advisories/GHSA-qq6c-99pv-prvf", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/pdm-project/pdm/releases/tag/2.27.0", "name": "https://github.com/pdm-project/pdm/releases/tag/2.27.0", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "PDM is a Python package and dependency manager. In versions up to and including 2.26.9, PDM automatically loads project-local plugins from a .pdm-plugins directory during initialization, allowing an attacker-controlled file in an untrusted repository checkout to execute arbitrary Python code before any command is parsed. This happens because load_plugins() runs during Core.init() and adds .pdm-plugins via site.addsitedir(), which processes .pth files and immediately executes any line beginning with import, so the code runs with the privileges of the user invoking pdm and even a benign command such as pdm --version triggers it (making the impact strongest in CI, automation, and privileged contexts). The issue is fixed in version 2.27.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-829", "description": "CWE-829: Inclusion of Functionality from Untrusted Control Sphere"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-94", "description": "CWE-94: Improper Control of Generation of Code ('Code Injection')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-04T18:42:23.036Z"}}}, "cveMetadata": {"cveId": "CVE-2026-47781", "state": "PUBLISHED", "dateUpdated": "2026-08-05T13:48:50.422Z", "dateReserved": "2026-05-19T22:36:16.883Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-08-04T18:42:23.036Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "pdm", "vendor": "pdm-project", "versions": [{"status": "affected", "version": "< 2.27.0"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "PDM is a Python package and dependency manager. In versions up to and including 2.26.9, PDM automatically loads project-local plugins from a .pdm-plugins directory during initialization, allowing an attacker-controlled file in an untrusted repository checkout to execute arbitrary Python code before any command is parsed. This happens because load_plugins() runs during Core.init() and adds .pdm-plugins via site.addsitedir(), which processes .pth files and immediately executes any line beginning with import, so the code runs with the privileges of the user invoking pdm and even a benign command such as pdm --version triggers it (making the impact strongest in CI, automation, and privileged contexts). The issue is fixed in version 2.27.0."}, {"lang": "es", "value": "PDM es un gestor de paquetes y dependencias de Python. En versiones hasta la 2.26.9 inclusive, PDM carga autom\u00e1ticamente plugins locales del proyecto desde un directorio .pdm-plugins durante la inicializaci\u00f3n, permitiendo que un archivo controlado por un atacante en una copia de repositorio no confiable ejecute c\u00f3digo Python arbitrario antes de que se analice cualquier comando. Esto sucede porque load_plugins() se ejecuta durante Core.init() y a\u00f1ade .pdm-plugins a trav\u00e9s de site.addsitedir(), que procesa archivos .pth y ejecuta inmediatamente cualquier l\u00ednea que comience con import, por lo que el c\u00f3digo se ejecuta con los privilegios del usuario que invoca pdm e incluso un comando benigno como pdm --version lo activa (haciendo que el impacto sea m\u00e1s fuerte en CI, automatizaci\u00f3n y contextos privilegiados). El problema est\u00e1 solucionado en la versi\u00f3n 2.27.0."}], "id": "CVE-2026-47781", "lastModified": "2026-10-24T16:10:00.153", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.4, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "ACTIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-47781", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-08-05T13:48:06.311095Z", "version": "2.0.3"}}]}, "published": "2026-08-04T19:16:51.240", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/pdm-project/pdm/releases/tag/2.27.0"}, {"source": "security-advisories@github.com", "url": "https://github.com/pdm-project/pdm/security/advisories/GHSA-qq6c-99pv-prvf"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/pdm-project/pdm/security/advisories/GHSA-qq6c-99pv-prvf"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-94"}, {"lang": "en", "value": "CWE-829"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2.27.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "product": "pdm", "vendor": "pdm-project"}], "created": "2026-08-04T21:00:11.266547+00:00", "updated": "2026-08-05T10:19:08.693781+00:00", "vendors": ["pdm-project", "pdm-project$PRODUCT$pdm"]}