Python-poetry - vulnerabilities (CVEs)

6 CVEs in 2 products, 0 in the last 30 days, newest from 2026-04-24.

Products

• Poetry - 4 CVEs
• Cleo - 1 CVEs

Newest CVEs of Python-poetry

• CVE-2026-41140 - CVSS 8.7 (high), 2026-04-24: Poetry is a dependency manager for Python. Prior to 2.3.4, the extractall() function in src/poetry/utils/helpers.py:410-426 extracts sdist tarballs without…
• CVE-2026-34591 - CVSS 7.1 (high), 2026-04-02: Poetry is a dependency manager for Python. From version 1.4.0 to before version 2.3.3, a crafted wheel can contain ../ paths that Poetry writes to disk…
• CVE-2022-42966 - CVSS 7.5 (high), 2022-11-09: An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the cleo PyPI package, when an attacker is able to supply arbitrary input to…
• CVE-2022-36069 - CVSS 7.3 (high), 2022-09-07: Poetry is a dependency manager for Python. When handling dependencies that come from a Git repository instead of a registry, Poetry uses various commands,…
• CVE-2022-36070 - CVSS 7.3 (high), 2022-09-07: Poetry is a dependency manager for Python. To handle dependencies that come from a Git repository, Poetry executes various commands, e.g. `git config`. These…
• CVE-2022-26184 - CVSS 9.8 (critical), 2022-03-21: Poetry v1.1.9 and below was discovered to contain an untrusted search path which causes the application to behave in unexpected ways when users execute Poetry…