GitHub Advisoryadvisory · PyPI
GHSA-xr2c-5w89-63pv Poetry before v1.1.9 contains Untrusted Search Path
CRITICAL
Official page ↗
- Aliases
- CVE-2022-26184
- Ecosystem
- PyPI
- Packages
- poetry
- Severity
- Critical
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-426
- Reviewed
- 2022-03-29
Affected packages
• PyPI poetry: < 1.1.9 → fixed in 1.1.9
Description
Poetry prior to v1.1.9 was discovered to contain an untrusted search path which causes the application to behave in unexpected ways when users execute Poetry commands in a directory containing malicious content. This vulnerability occurs when the application is ran on Windows OS.
Related
Alias · CVE (1)
- CVE-2022-26184 Poetry v1.1.9 and below was discovered to contain an untrusted search path which causes the application to behave in unexpected ways when… vulnerability
Weakness · CWE (1)
- CWE-426 Untrusted Search Path weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2022-26184 advisory
- https://github.com/python-poetry/poetry-core/pull/205/commits/fa9cb6f358ae840885c700f954317f34838caba7 web
- https://github.com/python-poetry/poetry-core/commit/1e1a109a1009daaab2367ce90c997f0cbbb0c1d1 web
- https://github.com/advisories/GHSA-xr2c-5w89-63pv advisory
- https://github.com/pypa/advisory-database/tree/main/vulns/poetry/PYSEC-2022-234.yaml web
- https://github.com/python-poetry web
- https://github.com/python-poetry/poetry/releases/tag/1.1.9 web
- https://www.sonarsource.com/blog/securing-developer-tools-package-managers web