Vulnerabilities for poetry

First version without a known vulnerability: 2.3.4

Details

• GHSA-73h3-mf4w-86472026-04-22

  Poetry has Path Traversal in tar extraction on Python 3.10.0 - 3.10.12 and 3.11.0 - 3.11.4

  Fixed in: 2.3.4

• GHSA-2599-h6xx-hpxp2026-04-01

  Poetry Has Wheel Path Traversal Which Can Lead to Arbitrary File Write

  Fixed in: 2.3.3

• GHSA-j4j9-7hg9-97g62022-10-11

  Poetry vulnerable to Untrusted Search Path leading to Local Code Execution on Windows

  Fixed in: 1.1.9

• GHSA-9xgj-fcgf-x6mw2022-09-16

  Poetry Argument Injection can lead to Local Code Execution

  Fixed in: 1.1.9

• GHSA-xr2c-5w89-63pv2022-03-23

  Poetry before v1.1.9 contains Untrusted Search Path

  Fixed in: 1.1.9