[GHSA-78v8-vpjp-cjqh] PDM wheel installation leads to Path Traversal via overridden write_to_fs - #9621
[GHSA-78v8-vpjp-cjqh] PDM wheel installation leads to Path Traversal via overridden write_to_fs#9621nikpivkin wants to merge 1 commit into
Conversation
|
Hi there @frostming! A community member has suggested an improvement to your security advisory. If approved, this change will affect the global advisory listed at github.com/advisories. It will not affect the version listed in your project repository. This change will be reviewed by our Security Curation Team. If you have thoughts or feedback, please share them in a comment here! If this PR has already been closed, you can start a new community contribution for this advisory |
There was a problem hiding this comment.
Copilot review overview
🟢 Approval recommended
The corrected range matches the upstream fix and release evidence.
Review effort: Balanced
Findings: None
What changed in this PR
Corrects the PDM advisory so all versions before 2.27.0 are marked vulnerable.
Changes:
- Removes the obsolete
<= 2.22.4affected-version limit. - Updates the advisory modification timestamp.
| File | Description |
|---|---|
GHSA-78v8-vpjp-cjqh.json |
Aligns the affected range with the verified 2.27.0 fix. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Updates
Comments
The vulnerable range should be < 2.27.0, not <= 2.22.4. The first patched version 2.27.0 is correct.
The fix is pdm-project/pdm#3787, merged as pdm-project/pdm@41aa5f9. Tag 2.27.0 contains it and tag 2.26.9 does not. The 2.27.0 release notes list it as "Fix a security issue with the installer to disallow installing to paths outside of the scheme directory": https://github.com/pdm-project/pdm/releases/tag/2.27.0
So versions 2.23.0 to 2.26.9 still have the vulnerable write_to_fs() but are outside the current range.