Critical severity · published Mar 21, 2022
CVE-2022-26184
Poetry v1.1.9 and below was discovered to contain an untrusted search path which causes the application to behave in unexpected ways when users execute Poetry commands in a…
9.8
CVSS
1.8%
EPSS
No
On KEV
Description
Poetry v1.1.9 and below was discovered to contain an untrusted search path which causes the application to behave in unexpected ways when users execute Poetry commands in a directory containing malicious content. This vulnerability occurs when the application is ran on Windows OS.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.8% · higher than 79% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PO
Poetry · Python-poetry
through 1.1.9 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-26184
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-26184
Patch
https://github.com/python-poetry/poetry-core/pull/205/commits/fa9cb6f358ae840885c700f954317f34838caba7
Release Notes
https://github.com/python-poetry/poetry/releases/tag/1.1.9
www.sonarsource.com
https://www.sonarsource.com/blog/securing-developer-tools-package-managers/
More from Poetry
8.7
CVE-2026-41140
Poetry: Path traversal in tar extraction on Python 3.10.0 - 3.10.12 and 3.11.0 - 3.11.4
7.3
CVE-2022-36070
Poetry is a dependency manager for Python
7.3
CVE-2022-36069
Poetry is a dependency manager for Python
6.5
CVE-2026-34591
Poetry Has Wheel Path Traversal Which Can Lead to Arbitrary File Write