Executive brief
PDM is a Python package and dependency manager used by developers to manage project environments. A vulnerability exists where PDM fails to check if its local configuration files are symbolic links before writing to them. If a user runs PDM commands within a malicious repository, an attacker could cause PDM to overwrite sensitive files elsewhere on the user's system, potentially leading to data loss or system instability.
Technical details
A symlink following vulnerability exists in PDM's project-local configuration handling. The `Config.__init__()` and `_save_config()` methods in `src/pdm/project/config.py` (and related sinks in `core.py` and `use.py`) resolve paths for files like `pdm.toml`, `.pdm-python`, and `.python-version` without using `O_NOFOLLOW` or `lstat` checks. An attacker can provide a malicious repository containing these files as symlinks pointing to sensitive locations on the victim's filesystem. When the victim executes PDM commands that update local state, PDM will follow the symlink and overwrite the target file with the privileges of the invoking user. For `pdm.toml`, the target must be valid TOML to pass the initial load step, but other sinks do not have this constraint. This has been patched in version 2.27.0.
Affected products
- pdm-project pdm < 2.27.0
Timeline
- 2026-05-21: disclosed
- 2026-06-10: patched: Fixed in version 2.27.0
- 2026-06-10: advisory