GHSA-xr2c-5w89-63pv

Poetry before v1.1.9 contains Untrusted Search Path

Source: GitHub Advisory Database (reviewed) Critical CVE-2022-26184

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	poetry	< 1.1.9	1.1.9

Details

As written in the advisory (Markdown source, shown as plain text).

Poetry prior to v1.1.9 was discovered to contain an untrusted search path which causes the application to behave in unexpected ways when users execute Poetry commands in a directory containing malicious content. This vulnerability occurs when the application is ran on Windows OS.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2022-26184 advisory
https://github.com/python-poetry/poetry-core/pull/205/commits/fa9cb6f358ae840885c700f954317f34838caba7 web
https://github.com/python-poetry/poetry-core/commit/1e1a109a1009daaab2367ce90c997f0cbbb0c1d1 web
https://github.com/advisories/GHSA-xr2c-5w89-63pv advisory
https://github.com/pypa/advisory-database/tree/main/vulns/poetry/PYSEC-2022-234.yaml web
https://github.com/python-poetry web
https://github.com/python-poetry/poetry/releases/tag/1.1.9 web
https://www.sonarsource.com/blog/securing-developer-tools-package-managers web