python-poetry

4 results · Feed

• Low 0.6
  CVE-2026-41140

  Poetry: Path traversal in tar extraction on Python 3.10.0 - 3.10.12 and 3.11.0 - 3.11.4

  Poetry is a dependency manager for Python. Prior to 2.3.4, the extractall() function in src/poetry/utils/helpers.py:410-426 extracts sdist tarballs without path traversal protection on Python versions where tarfile.data_filter is unavailable. Considering only…

  python-poetry poetry poetry poetry Debian Ubuntu PyPI
  Apr 24, 2026
• High 7.1
  CVE-2026-34591

  Poetry Has Wheel Path Traversal Which Can Lead to Arbitrary File Write

  Poetry is a dependency manager for Python. From version 1.4.0 to before version 2.3.3, a crafted wheel can contain ../ paths that Poetry writes to disk without containment checks, allowing arbitrary file write with the privileges of the Poetry process. It is …

  python-poetry poetry poetry poetry Debian Ubuntu PyPI
  Apr 2, 2026
• High 7.3
  CVE-2022-36069

  Poetry Argument Injection vulnerability can lead to local Code Execution

  Poetry is a dependency manager for Python. When handling dependencies that come from a Git repository instead of a registry, Poetry uses various commands, such as `git clone`. These commands are constructed using user input (e.g. the repository URL). When bui…

  python-poetry poetry poetry poetry Debian Ubuntu PyPI
  Sep 7, 2022
• High 7.3
  CVE-2022-36070

  Poetry's Untrusted Search Path can lead to Local Code Execution on Windows

  Poetry is a dependency manager for Python. To handle dependencies that come from a Git repository, Poetry executes various commands, e.g. `git config`. These commands are being executed using the executable’s name and not its absolute path. This can lead to t…

  python-poetry poetry poetry PyPI
  Sep 7, 2022