Executive brief
PDM, a popular Python package and dependency manager, is vulnerable to arbitrary code execution when running commands within a malicious project directory. An attacker can include a hidden configuration file in a repository that PDM will automatically execute before performing any requested actions. This could allow an attacker to steal credentials, tamper with code, or gain persistent access to a developer's machine or CI/CD environment if they simply run a basic command like 'pdm --version' inside the untrusted folder.
Technical details
A code injection vulnerability exists in PDM due to the way it handles project-local plugins during Core initialization. The `load_plugins()` function calls `_add_project_plugins_library()`, which utilizes `site.addsitedir()` to add the `.pdm-plugins` directory to the Python path. On CPython, `site.addsitedir()` automatically processes `.pth` files, executing any lines starting with 'import'. Because this occurs before CLI command parsing, an attacker can achieve arbitrary code execution with the privileges of the invoking user by placing a malicious `.pth` file in a project repository. This requires the victim to run any PDM command (even low-impact ones like `--version`) within the malicious directory. The issue is fixed in version 2.27.0.
Affected products
- pdm-project pdm <= 2.26.9
Timeline
- 2026-05-21: disclosed
- 2026-06-11: advisory: GitHub Advisory published
- 2026-06-11: patched: Version 2.27.0 released