Vulnerabilities for pdm

First version without a known vulnerability: 2.27.0

Details

• GHSA-qq6c-99pv-prvf2026-06-11

  PDM: Project-Controlled `.pdm-plugins` Content Executes Before CLI Parsing

  Fixed in: 2.27.0

• GHSA-78v8-vpjp-cjqh2026-06-10

  PDM wheel installation leads to Path Traversal via overridden write_to_fs

  Fixed in: 2.27.0

• GHSA-ghq2-5c67-fprm2026-06-10

  PDM: Project-Local State and Config Writes Follow Symlinks

  Fixed in: 2.27.0

• GHSA-j44v-mmf2-xvm92023-10-20

  PDM Trojan Lockfile

  Fixed in: 2.10.0