PDM automatically loads project‑local plugins from a .pdm-plugins directory during initialization. Until version 2.26.9, the load_plugins() routine runs inside Core.init() and adds the directory via site.addsitedir(), which processes .pth files and immediately executes any line starting with an import statement. Consequently, an attacker‑controlled file in an untrusted repository can execute arbitrary Python code with the privileges of the user running pdm, even when invoking a benign command such as pdm --version. The weakness is a form of code injection (CWE‑94) combined with missing access control (CWE‑829), allowing this exploit to occur before any command is parsed.

The vulnerability affects the PDM Python package and dependency manager distributed by pdm‑project. All releases up to and including 2.26.9 are impacted. The problem was addressed in release 2.27.0, which removes automatic loading of project‑local plugins prior to command parsing.

The CVSS score of 8.4 indicates a high‑severity impact, and the issue is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is a user or CI environment that can supply a malicious project repository; the plugin code runs with the invoking user’s rights whenever any pdm command is executed. A successful exploitation leads to arbitrary code execution at the user level, potentially compromising CI pipelines, automation scripts, or any privileged context in which pdm is run.