Skip to content
OpenAdvisories

Vendor

python-poetry

4 known vulnerabilities.

Products

poetry 4
All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Low 0.6
    CVE-2026-41140

    Poetry: Path traversal in tar extraction on Python 3.10.0 - 3.10.12 and 3.11.0 - 3.11.4

    Poetry is a dependency manager for Python. Prior to 2.3.4, the extractall() function in src/poetry/utils/helpers.py:410-426 extracts sdist tarballs without path traversal protection on Python versions where tarfile.data_filter is unavailable. Considering only…

    python-poetry poetry poetry poetry Debian Ubuntu PyPI