CVE-2026-47763 Overview
CVE-2026-47763 affects PDM, a Python package and dependency manager supporting the latest PEP standards. Versions prior to 2.27.0 write several project-local state and configuration files without symlink protection. A malicious repository can plant these files as symlinks pointing to sensitive targets on the local system. When a developer runs PDM against the cloned repository, the tool follows the symlink and overwrites the target file with the invoking user's privileges. This produces an arbitrary file clobber primitive scoped to the user account executing PDM. The maintainers addressed the issue in version 2.27.0. This weakness is categorized under [CWE-61: UNIX Symbolic Link (Symlink) Following].
Critical Impact
A cloned malicious repository can overwrite arbitrary files writable by the invoking user, enabling integrity compromise of local development environments.
Affected Products
- PDM (Python Development Master) versions prior to 2.27.0
- Projects consuming untrusted repositories with local PDM operations
- Developer workstations and continuous integration runners executing PDM against attacker-controlled sources
Discovery Timeline
- 2026-08-04 - CVE-2026-47763 published to NVD
- 2026-08-05 - Last updated in NVD database
Technical Details for CVE-2026-47763
Vulnerability Analysis
The vulnerability stems from PDM writing project-local files without using lstat checks or the O_NOFOLLOW flag. The Config.__init__() method resolves the project-local pdm.toml path, and _save_config() writes to the resolved target. When PROJECT_ROOT/pdm.toml is a symlink to another file on disk, invoking pdm config -l ... updates the symlink target instead of refusing the operation. The same pattern applies to other project-local persistence sinks, including .pdm-python and .python-version. Attackers exploit this by publishing a repository that ships one of these files as a symlink to a sensitive target such as a shell configuration file, a cron entry, or an SSH authorized_keys file. When a developer clones the repository and runs standard PDM commands, PDM writes to the attacker-chosen target.
Root Cause
The root cause is missing symlink protection in PDM's file persistence layer. The code resolves paths and opens them for writing without verifying whether the path component is a regular file. Python's default open() on POSIX follows symbolic links, so any file operation that omits O_NOFOLLOW inherits this behavior. The maintainers did not enforce lstat inspection before write, allowing PDM to traverse attacker-controlled links.
Attack Vector
Exploitation requires local execution of PDM against attacker-supplied repository content. The attacker publishes a repository where pdm.toml, .pdm-python, or .python-version is a symlink to a target file. The victim clones the repository and runs a PDM command that writes to one of these sinks. For the pdm.toml sink, the target file must already contain parseable TOML because PDM loads the file before writing. The .pdm-python and .python-version sinks have no parser constraint and support arbitrary target files. User interaction is required, and the write operates with the invoking user's privileges.
See the GitHub Security Advisory GHSA-ghq2-5c67-fprm for the proof-of-concept description and affected code paths.
Detection Methods for CVE-2026-47763
Indicators of Compromise
- Presence of pdm.toml, .pdm-python, or .python-version as symbolic links inside a cloned repository rather than regular files
- Unexpected modifications to user-writable files such as shell rc files, cron tables, or SSH configuration following PDM operations
- Repository commits that introduce symlinks pointing outside the project directory
Detection Strategies
- Scan repositories with find . -type l -name 'pdm.toml' -o -name '.pdm-python' -o -name '.python-version' before running PDM commands
- Enable file integrity monitoring on developer workstations to flag writes to sensitive user files initiated by Python processes
- Audit continuous integration runner logs for PDM invocations against untrusted branches or forks
Monitoring Recommendations
- Correlate process telemetry for pdm executions with subsequent file writes to paths outside the project root
- Alert on symlink creation in Python project directories where source repositories originate from external contributors
- Track PDM versions across developer environments and flag installations below 2.27.0
How to Mitigate CVE-2026-47763
Immediate Actions Required
- Upgrade PDM to version 2.27.0 or later on all developer workstations and CI systems
- Inventory repositories currently in use and inspect them for symlinked PDM state files
- Restrict PDM execution against untrusted or unreviewed repositories until upgrades complete
Patch Information
The maintainers fixed CVE-2026-47763 in PDM 2.27.0. The release adds symlink protection to project-local file writes, refusing operations when the target is a symbolic link. Release notes and upgrade instructions are available at the PDM 2.27.0 GitHub Release.
Workarounds
- Manually verify that pdm.toml, .pdm-python, and .python-version are regular files before running PDM against any newly cloned repository
- Execute PDM inside a sandboxed container or ephemeral virtual machine to contain arbitrary file writes
- Run PDM under a dedicated low-privilege user account that lacks access to sensitive host configuration files
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
