# CVE-2026-47781: pdm-project PDM code execution via project-local plugins

Source: https://junglewise.ai/threats/cve-2026-47781-pdm-project-pdm-code-execution-via-project-local-plugins  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-04. Updated: 2026-06-11  
License: CC BY 4.0 with a link back

CVE-2026-47781 · Severity: high · CVSS 4 · Published 2026-08-04

PDM, a popular Python package and dependency manager, is vulnerable to arbitrary code execution when running commands within a malicious project directory. An attacker can include a hidden configuration file in a repository that PDM will automatically execute before performing any requested actions. This could allow an attacker to steal credentials, tamper with code, or gain persistent access to a developer's machine or CI/CD environment if they simply run a basic command like 'pdm --version' inside the untrusted folder.

Technologies: [pdm (PyPI)](https://junglewise.ai/threats/technologies/pdm). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-47781 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-47781 being exploited in the wild.

**How severe is CVE-2026-47781?** High severity, with a CVSS score of 4, published 4 August 2026.

**Which products and versions are affected?** pdm (PyPI) <= 2.26.9, ECOSYSTEM:introduced=0,fixed=2.27.0.

**Is there a fix for CVE-2026-47781?** Yes. pdm (PyPI): upgrade to 2.27.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-47781 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-47781?** Check whether you run pdm (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- pdm (PyPI): upgrade to 2.27.0 or later

  ```sh
  pip install "pdm>=2.27.0"
  ```


## Technical details

A code injection vulnerability exists in PDM due to the way it handles project-local plugins during Core initialization. The `load_plugins()` function calls `_add_project_plugins_library()`, which utilizes `site.addsitedir()` to add the `.pdm-plugins` directory to the Python path. On CPython, `site.addsitedir()` automatically processes `.pth` files, executing any lines starting with 'import'. Because this occurs before CLI command parsing, an attacker can achieve arbitrary code execution with the privileges of the invoking user by placing a malicious `.pth` file in a project repository. This requires the victim to run any PDM command (even low-impact ones like `--version`) within the malicious directory. The issue is fixed in version 2.27.0.

## Affected products

- pdm-project pdm <= 2.26.9

## Identifiers

- CVE-2026-47781
- GHSA-qq6c-99pv-prvf
- PYSEC-2026-2863

## Timeline

- 2026-05-21: disclosed
- 2026-06-11: advisory: GitHub Advisory published
- 2026-06-11: patched: Version 2.27.0 released

## References

- [https://api.github.com/users/xuemian168](https://api.github.com/users/xuemian168)
- [https://github.com/xuemian168](https://github.com/xuemian168)
- [https://api.github.com/users/xuemian168/gists%7B/gist_id%7D](https://api.github.com/users/xuemian168/gists%7B/gist_id%7D)
- [https://api.github.com/users/xuemian168/repos](https://api.github.com/users/xuemian168/repos)
- [https://avatars.githubusercontent.com/u/38741078?v=4](https://avatars.githubusercontent.com/u/38741078?v=4)
- [https://api.github.com/users/xuemian168/events%7B/privacy%7D](https://api.github.com/users/xuemian168/events%7B/privacy%7D)

## Related threats

- [PDM path traversal in wheel installation via write_to_fs](https://junglewise.ai/threats/cve-2026-47764-pdm-path-traversal-in-wheel-installation-via-write-to-fs)
- [pdm-project PDM symlink following in project-local config writes](https://junglewise.ai/threats/cve-2026-47763-pdm-project-pdm-symlink-following-in-project-local-config-writes)
- [PYSEC-2026-1763 - PDM Trojan Lockfile](https://junglewise.ai/threats/cve-2023-45805-pdm-trojan-lockfile)