{
  "cveId": "CVE-2023-45805",
  "url": "https://patchblox.com/security/cve/CVE-2023-45805",
  "summary": "CVE-2023-45805 is fixed in pdm on 1 platform, first by DEBIAN-CVE-2023-45805, released October 20, 2023. It is not reported as exploited. Patch Radar priority: High.",
  "title": "pdm: pdm is a Python package and dependency manager supporting the latest PEP standards",
  "description": "pdm is a Python package and dependency manager supporting the latest PEP standards. It\u0027s possible to craft a malicious \u0060pdm.lock\u0060 file that could allow e.g. an insider or a malicious open source project to appear to depend on a trusted PyPI project, but actually install another project. A project \u0060foo\u0060 can be targeted by creating the project \u0060foo-2\u0060 and uploading the file \u0060foo-2-2.tar.gz\u0060 to pypi.org. PyPI will see this as project \u0060foo-2\u0060 version \u00602\u0060, while PDM will see this as project \u0060foo\u0060 version \u00602-2\u0060. The version must only be \u0060parseable as a version\u0060 and the filename must be a prefix of the project name, but it\u0027s not verified to match the version being installed. Version \u00602-2\u0060 is also not a valid normalized version per PEP 440. Matching the project name exactly (not just prefix) would fix the issue. When installing dependencies with PDM, what\u0027s actually installed could differ from what\u0027s listed in \u0060pyproject.toml\u0060 (including arbitrary code execution on install). It could also be used for downgrade attacks by only changing the version. This issue has been addressed in commit \u00606853e2642df\u0060 which is included in release version \u00602.9.4\u0060. Users are advised to upgrade. There are no known workarounds for this vulnerability.",
  "published": "2023-10-20T19:15:08Z",
  "severity": "high",
  "cvss": 7.8,
  "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
  "epss": 0.00452,
  "epssPercentile": 0.39467,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "pdm",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "2.20.0.post1\u002Bds1-1",
      "fix": "DEBIAN-CVE-2023-45805",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2023-45805",
      "released": "2023-10-20T19:15:08Z"
    },
    {
      "platform": "linux",
      "product": "pdm",
      "release": "Debian 14",
      "fixedVersion": "2.20.0.post1\u002Bds1-1",
      "fix": "DEBIAN-CVE-2023-45805",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2023-45805",
      "released": "2023-10-20T19:15:08Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T13:06:02Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}