Detections
Analytics

SCA: security update for pdm (GHSA-ghq2-5c67-fprm)

medium Tenable Cloud Security Plugin ID 443061

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - pdm is a Python package and dependency manager supporting the latest PEP standards. In versions prior to
 2.27.0, pdm writes several project-local state or configuration files without symlink protection. If a
 malicious repository places those files as symlinks, local PDM operations can overwrite the symlink
 targets. This creates an arbitrary file clobber primitive relative to the privileges of the invoking user.
 Config.__init__() resolves the project-local pdm.toml path and _save_config() writes to the resolved
 target. If PROJECT_ROOT/pdm.toml is a symlink to another file, pdm config -l ... updates the target file
 instead of refusing the write. The same general problem exists for other project-local persistence paths
 that are written directly with no lstat / O_NOFOLLOW protection. For the pdm.toml PoC specifically, the
 target file must already contain parseable TOML. Otherwise the load step fails before the write path is
 reached. That parser constraint does not apply to the .pdm-python or .python-version sinks. This issue has
 been fixed in version 2.27.0. (CVE-2026-47763)

Solution

Update the pdm library and its related packages to version 2.27.0 or later.

See Also

https://github.com/advisories/GHSA-ghq2-5c67-fprm

Plugin Details

Severity: Medium

ID: 443061

Version: Revision 1.4

Type: Local

Family: SCA Checks

Published: 6/11/2026

Updated: 8/5/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 58.03

Vendor

Vendor Severity: Medium

CVSS v4

Risk Factor: Medium

Base Score: 6.8

Threat Score: 4.2

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N

CVSS Score Source: CVE-2026-47763

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 6/10/2026

Vulnerability Publication Date: 6/10/2026

Reference Information

CVE: CVE-2026-47763

cwe: CWE-61