# CVE-2023-45805: PYSEC-2026-1763 - PDM Trojan Lockfile

Source: https://junglewise.ai/threats/cve-2023-45805-pdm-trojan-lockfile  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-07  
License: CC BY 4.0 with a link back

CVE-2023-45805 · Severity: low · CVSS 3.1 · Published 2026-07-07

PDM Trojan Lockfile

Technologies: [pdm (PyPI)](https://junglewise.ai/threats/technologies/pdm). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2023-45805 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2023-45805 being exploited in the wild.

**How severe is CVE-2023-45805?** Low severity, with a CVSS score of 3.1, published 7 July 2026.

**Which products and versions are affected?** pdm (PyPI) ECOSYSTEM:introduced=0,fixed=2.10.0, ECOSYSTEM:introduced=0,last_affected=2.9.3.

**Is there a fix for CVE-2023-45805?** Yes. pdm (PyPI): upgrade to 2.10.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**Am I affected by CVE-2023-45805?** Check whether you run pdm (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- pdm (PyPI): upgrade to 2.10.0 or later

  ```sh
  pip install "pdm>=2.10.0"
  ```


## Affected products

- pdm (PyPI) ECOSYSTEM:introduced=0,fixed=2.10.0, ECOSYSTEM:introduced=0,last_affected=2.9.3

## Identifiers

- CVE-2023-45805
- GHSA-j44v-mmf2-xvm9
- PYSEC-2026-1763

## Related threats

- [pdm-project PDM code execution via project-local plugins](https://junglewise.ai/threats/cve-2026-47781-pdm-project-pdm-code-execution-via-project-local-plugins)
- [PDM path traversal in wheel installation via write_to_fs](https://junglewise.ai/threats/cve-2026-47764-pdm-path-traversal-in-wheel-installation-via-write-to-fs)
- [pdm-project PDM symlink following in project-local config writes](https://junglewise.ai/threats/cve-2026-47763-pdm-project-pdm-symlink-following-in-project-local-config-writes)