p PatchFirst

CVE-2022-26184

CVE-2022-26184

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Poetry v1.1.9 and below was discovered to contain an untrusted search path which causes the application to behave in unexpected ways when users execute Poetry commands in a directory containing malicious content. This vulnerability occurs when the application is ran on Windows OS.

CVSS 9.8 · Critical · EPSS 1.8% · Fix available

Published
Updated

Stack: system · python

Affected products and versions

  • n/a

    Versions
    • n/a: Affected

    No fix published

  • poetry PyPI

    Versions
    • 0.1.0
    • 0.10.0
    • 0.10.0a0
    • 0.10.0a1
    • 0.10.0a2
    • 0.10.0a3
    • 0.10.1
    • 0.10.2
    • 0.10.3
    • 0.11.0
    • 0.11.0a0
    • 0.11.0a1
    • 0.11.0a2
    • 0.11.0a3
    • 0.11.0a4
    • 0.11.1
    • 0.11.2
    • 0.11.3
    • 0.11.4
    • 0.11.5
    • 0.12.0
    • 0.12.0a0
    • 0.12.0a1
    • 0.12.0a2
    • 0.12.0a3
    • 0.12.0a4
    • 0.12.0a5
    • 0.12.1
    • 0.12.10
    • 0.12.11
    • 0.12.12
    • 0.12.13
    • 0.12.14
    • 0.12.15
    • 0.12.16
    • 0.12.17
    • 0.12.2
    • 0.12.3
    • 0.12.4
    • 0.12.5
    • 0.12.6
    • 0.12.7
    • 0.12.8
    • 0.12.9
    • 0.2.0
    • 0.3.0
    • 0.4.0
    • 0.4.0.post1
    • 0.4.1
    • 0.4.2
    • 0.5.0
    • 0.5.0b1
    • 0.5.0b2
    • 0.6.0
    • 0.6.1
    • 0.6.2
    • 0.6.3
    • 0.6.3b1
    • 0.6.3b2
    • 0.6.3b3
    • 0.6.3b4
    • 0.6.3b5
    • 0.6.3b6
    • 0.6.3b7
    • 0.6.4
    • 0.6.4b1
    • 0.6.5
    • 0.7.0
    • 0.7.0b1
    • 0.7.0b2
    • 0.7.0b3
    • 0.7.0b4
    • 0.7.1
    • 0.8.0
    • 0.8.0a0
    • 0.8.0a1
    • 0.8.0a2
    • 0.8.0a3
    • 0.8.0a4
    • 0.8.1
    • 0.8.1a0
    • 0.8.2
    • 0.8.3
    • 0.8.4
    • 0.8.5
    • 0.8.5a0
    • 0.8.6
    • 0.9.0
    • 0.9.0a0
    • 0.9.0a1
    • 0.9.0a2
    • 0.9.0a3
    • 0.9.1
    • 1.0.0
    • 1.0.0a0
    • 1.0.0a1
    • 1.0.0a2
    • 1.0.0a3
    • 1.0.0a4
    • 1.0.0a5
    • 1.0.0b1
    • 1.0.0b2
    • 1.0.0b3
    • 1.0.0b4
    • 1.0.0b5
    • 1.0.0b6
    • 1.0.0b7
    • 1.0.0b8
    • 1.0.0b9
    • 1.0.1
    • 1.0.10
    • 1.0.2
    • 1.0.3
    • 1.0.4
    • 1.0.5
    • 1.0.6
    • 1.0.7
    • 1.0.8
    • 1.0.9
    • 1.1.0
    • 1.1.0a1
    • 1.1.0a2
    • 1.1.0a3
    • 1.1.0b1
    • 1.1.0b2
    • 1.1.0b3
    • 1.1.0b4
    • 1.1.0rc1
    • 1.1.1
    • 1.1.2
    • 1.1.3
    • 1.1.4
    • 1.1.5
    • 1.1.6
    • 1.1.7
    • 1.1.8
    Affected ranges
    • ECOSYSTEM: < 1.1.9

    Update to 1.1.9

  • poetry Ubuntu:22.04:LTS

    Versions
    • 1.1.11+dfsg-3
    • 1.1.12+dfsg-1
    • 1.1.12+dfsg-1ubuntu1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • poetry-core Ubuntu:22.04:LTS

    Versions
    • 1.0.0-3
    • 1.0.7-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • poetry Ubuntu:24.04:LTS

    Versions
    • 1.6.1+dfsg-2
    • 1.7.1+dfsg-1
    • 1.8.2+dfsg-1ubuntu2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • poetry-core Ubuntu:24.04:LTS

    Versions
    • 1.6.1-1
    • 1.7.0-1
    • 1.8.1-1build1
    • 1.9.0-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • poetry Ubuntu:25.10

    Versions
    • 2.1.1+dfsg-3
    • 2.1.2+dfsg-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • poetry-core Ubuntu:25.10

    Versions
    • 2.1.1-3
    • 2.1.2-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • poetry Ubuntu:26.10

    Versions
    • 2.3.2+dfsg-3
    • 2.3.4-0.1
    • 2.3.4-1
    • 2.3.4-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • poetry-core Ubuntu:26.10

    Versions
    • 2.3.1-1
    • 2.3.1-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • poetry Ubuntu:26.04:LTS

    Versions
    • 2.1.2+dfsg-1
    • 2.3.2+dfsg-3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • poetry-core Ubuntu:26.04:LTS

    Versions
    • 2.1.2-2
    • 2.2.1-2
    • 2.3.1-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →