Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
pdm-project/pdm
main @ ef05456
19
Fixes
1
CVEs
HIGH
Peak severity
52.9%
Coverage
Highlights
Information Disclosure: 5 prior fixes. Scrutinize any change in this area.
src/pdm/cli/commands/run.py: most-fixed (2 issues). Treat as high-risk during review.
4 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Dependency Confusion: PDM failed to enforce package-index-binding constraints during candidate link collection, allowing an attacker to exploit dependency confusion by registering public packages that override intended internal ones. Always ensure candidate searches strictly honor index-binding restrictions.
Command Injection: Insecure interpolation of command-line arguments in scripts permitted arbitrary command execution. Command execution surfaces must utilize robust, shell-safe escaping libraries such as shlex.quote rather than simple regex substitution or formatting.
Auth Bypass: As tracked by CVE-2023-45805, untrusted static URLs embedded within user lockfiles could bypass typical package validation constraints, leading to arbitrary malicious package installation. Restricting and validating static URL resolution in lockfiles is vital.