CVE-2026-47763: 
Python vulnerability analysis and mitigation

CVE-2026-47763 is a UNIX symbolic link (symlink) following vulnerability in PDM, a Python package and dependency manager. Affecting all versions prior to 2.27.0, the flaw allows a malicious repository to place project-local configuration files (e.g., pdm.toml, .pdm-python, .python-version) as symlinks, causing PDM write operations to overwrite the symlink targets — creating an arbitrary file clobber primitive. The vulnerability was disclosed on May 21, 2026, and published to the GitHub Advisory Database on June 10, 2026. It carries a CVSS v4.0 base score of 6.8 (Medium) (Github Advisory, PDM Security Advisory).

The root cause is classified under CWE-61 (UNIX Symbolic Link Following) and CWE-59 (Improper Link Resolution Before File Access). Specifically, Config.__init__() in src/pdm/project/config.py resolves the project-local pdm.toml path, and _save_config() writes to the resolved target without performing lstat or using O_NOFOLLOW protection — meaning if PROJECT_ROOT/pdm.toml is a symlink, PDM will write to the symlink's target rather than refusing the operation. The same issue affects .pdm-python and .python-version sinks (in src/pdm/project/core.py:209-217 and src/pdm/cli/commands/use.py:187-189). For the pdm.toml sink, the target file must already contain parseable TOML for exploitation to succeed; this constraint does not apply to the other two sinks. A public proof-of-concept is included in the advisory (PDM Security Advisory, Github Advisory).

Successful exploitation enables arbitrary file clobber with the privileges of the user invoking PDM, allowing destructive modification of files outside the repository root. There is no direct confidentiality impact (the primitive is write-only), but integrity is highly impacted as an attacker can overwrite arbitrary files accessible to the invoking user. The risk is elevated when PDM is run in privileged contexts (e.g., CI/CD pipelines or as a system administrator), where the clobber primitive could be leveraged for privilege abuse or disruption of critical system files (PDM Security Advisory).

A proof-of-concept exploit is publicly available and included in the official security advisory, demonstrating the symlink clobber via pdm config -l venv.in_project false against a prepared repository. Exploitation requires local access and active user interaction (the victim must run a PDM command that writes project-local state), making it non-automatable. The EPSS score is approximately 0.024% (0.000240), indicating a low near-term exploitation probability. There is no evidence of in-the-wild exploitation, no known threat actor attribution, and the vulnerability is not listed in the CISA KEV catalog. NVD SSVC classifies exploitation status as "poc" (Github Advisory, PDM Security Advisory).

1. Prepare a malicious repository: Create a project directory containing a valid pyproject.toml and replace pdm.toml with a symlink pointing to a target file outside the repository root (e.g., a sensitive TOML-parseable configuration file owned by the victim user).
2. Ensure target file is parseable TOML (for the pdm.toml sink): The symlink target must contain valid TOML content; otherwise, PDM's load step will fail before the write is reached. This constraint does not apply to .pdm-python or .python-version sinks.
3. Social-engineer the victim: Convince the target user to clone or open the malicious repository and run any PDM command that writes project-local state or config, such as pdm config -l venv.in_project false.
4. Trigger the write: When PDM executes, Config.__init__() resolves the pdm.toml path (following the symlink) and _save_config() writes the updated configuration to the symlink's target file, overwriting its contents with attacker-influenced data.
5. Achieve file clobber: The target file outside the repository root is now modified with PDM configuration values, potentially corrupting critical files or enabling further privilege abuse if PDM was run with elevated permissions (PDM Security Advisory, Github Advisory).

• File System: Presence of pdm.toml, .pdm-python, or .python-version as symbolic links (rather than regular files) within a cloned repository's project root; unexpected modification timestamps on files outside the repository root that coincide with PDM command execution.
• Logs: Shell history or audit logs showing pdm config -l, pdm use, or similar PDM commands executed within a directory containing symlinked project-local files.
• Process: PDM process (python -m pdm) writing to file paths outside the expected project directory, observable via strace/auditd file write events targeting unexpected destinations.

Upgrade PDM to version 2.27.0 or later, which refuses to write project-local config and state files (pdm.toml, .pdm-python, .python-version) when the destination is a symlink. No configuration-based workaround is available for older versions; the fix requires the code-level change introduced in the 2.27.0 release. Users running PDM in CI/CD pipelines or with elevated privileges should treat this as a priority upgrade, particularly when processing untrusted repositories (PDM Release 2.27.0, Github Advisory).

The vulnerability was reported by security researcher xuemian168 and analyzed by ZejiHui, with the advisory published by PDM maintainer frostming. openSUSE issued security announcements covering the PDM update as part of broader package security updates (openSUSE Security Announce). Tenable added detection coverage via Nessus plugins 324056 and 332063. No significant broader media coverage or social media discussion has been identified.