Trojan Lockfilein pdm

CVE-2023-45805

What is CVE-2023-45805?

A vulnerability in the pdm Python package manager enables attackers to craft malicious pdm.lock files, causing legitimate dependencies to be replaced with untrusted packages. This flaw allows an insider or deceitful open-source project to falsely appear as if it relies on a trusted project from PyPI. By manipulating version parsing and filename prefixes, attackers can execute arbitrary code upon installation. Users must upgrade to pdm version 2.9.4 or later, as there are no known workarounds to mitigate the risks associated with this vulnerability.

References