Python-poetry vulnerabilities
We track 4 vulnerabilities in Python-poetry products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on April 24, 2026.
Latest Python-poetry vulnerabilities
- 8.7 High severity
poetry: Improper Limitation of a Pathname to a Restricted Directory
Poetry is a dependency manager for Python. Prior to 2.3.4, the extractall() function in src/poetry/utils/helpers.py:410-426 extracts sdist tarballs without path traversal protection on Python versions where tarfile.data_filter is unavailable. Considering only
- 7.3 High severity
poetry: Untrusted Search Path
Poetry is a dependency manager for Python. To handle dependencies that come from a Git repository, Poetry executes various commands, e.g. `git config`. These commands are being executed using the executable’s name and not its absolute path. This can lead to th
- 7.3 High severity
poetry: Improper Neutralization of Argument Delimiters in a Command
Poetry is a dependency manager for Python. When handling dependencies that come from a Git repository instead of a registry, Poetry uses various commands, such as `git clone`. These commands are constructed using user input (e.g. the repository URL). When buil
- 9.8 Critical severity
Poetry: Untrusted Search Path
Poetry v1.1.9 and below was discovered to contain an untrusted search path which causes the application to behave in unexpected ways when users execute Poetry commands in a directory containing malicious content. This vulnerability occurs when the application