CVE-2022-26184

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Poetry v1.1.9 and below was discovered to contain an untrusted search path which causes the application to behave in unexpected ways when users execute Poetry commands in a directory containing malicious content. This vulnerability occurs when the application is ran on Windows OS.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-426

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/python-poetry/poetry-core/pull/205/commits/fa9cb6f358ae840885c700f954317f34838caba7Patch, Third Party Advisory
https://github.com/python-poetry/poetry/releases/tag/1.1.9Release Notes, Third Party Advisory
https://www.sonarsource.com/blog/securing-developer-tools-package-managers/
https://github.com/python-poetry/poetry-core/pull/205/commits/fa9cb6f358ae840885c700f954317f34838caba7Patch, Third Party Advisory
https://github.com/python-poetry/poetry/releases/tag/1.1.9Release Notes, Third Party Advisory
https://www.sonarsource.com/blog/securing-developer-tools-package-managers/

Timeline

Published: Mar 21, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-261869.8TOTOLINK N600R V4.3.0cu.7570_B20200620 was discovered to contain a command injection vulnerability via the exportOvpn interface at cstecgi.c CVE-2022-261879.8TOTOLINK N600R V4.3.0cu.7570_B20200620 was discovered to contain a command injection vulnerability via the pingCheck function.CVE-2022-261889.8TOTOLINK N600R V4.3.0cu.7570_B20200620 was discovered to contain a command injection vulnerability via /setting/NTPSyncWithHost.CVE-2022-261899.8TOTOLINK N600R V4.3.0cu.7570_B20200620 was discovered to contain a command injection vulnerability via the langType parameter in the login i CVE-2022-26194.3Insufficient validation of untrusted input in Settings in Google Chrome prior to 104.0.5112.79 allowed an attacker who convinced a user to i CVE-2022-261975.4Joget DX 7 was discovered to contain a cross-site scripting (XSS) vulnerability via the Datalist table.CVE-2022-261989.8Notable v1.8.4 does not filter text editing, allowing attackers to execute arbitrary code via a crafted payload injected into the Title text CVE-2022-26208.8Use after free in WebUI in Google Chrome on Chrome OS prior to 104.0.5112.79 allowed a remote attacker who convinced a user to engage in spe CVE-2022-262019.8Victor CMS v1.0 was discovered to contain a SQL injection vulnerability.CVE-2022-262059.8Marky commit 3686565726c65756e was discovered to contain a remote code execution (RCE) vulnerability via the Display text fields. This vulne CVE-2022-262069.8Totolink A830R V5.9c.4729_B20191112, A3100R V4.1.2cu.5050_B20200504, A950RG V4.1.2cu.5161_B20200903, A800R V4.1.2cu.5137_B20200730, A3000RU CVE-2022-262079.8Totolink A830R V5.9c.4729_B20191112, A3100R V4.1.2cu.5050_B20200504, A950RG V4.1.2cu.5161_B20200903, A800R V4.1.2cu.5137_B20200730, A3000RU