CVE-2022-26184

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2022-26184
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-26184.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2022-26184
Aliases
Downstream
Published
2022-03-21T00:00:00Z
Modified
2026-07-15T01:49:14.897042049Z
Summary
[none]
Details

Poetry v1.1.9 and below was discovered to contain an untrusted search path which causes the application to behave in unexpected ways when users execute Poetry commands in a directory containing malicious content. This vulnerability occurs when the application is ran on Windows OS.

Database specific 
{
    "cna_assigner": "mitre",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/26xxx/CVE-2022-26184.json"
}
References

Affected packages

Git / github.com/python-poetry/poetry

Affected ranges

Type
GIT
Repo
https://github.com/python-poetry/poetry
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
69bd6820e320f84900103fdf867e24b355d6aa5d
Database specific 
{
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ],
    "cpe": "cpe:2.3:a:python-poetry:poetry:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "1.1.9"
        }
    ]
}

Affected versions

0.*
0.1.0
0.10.0
0.10.1
0.10.2
0.10.3
0.12.0
0.12.0a0
0.12.0a1
0.12.0a2
0.12.0a3
0.12.0a4
0.12.0a5
0.12.1
0.12.2
0.12.3
0.12.4
0.2.0
0.3.0
0.4.0
0.4.1
0.4.2
0.5.0
0.6.0
0.6.1
0.6.2
0.6.3
0.6.4
0.6.5
0.7.0
0.7.1
0.8.0
0.8.1
0.8.2
0.8.3
0.9.0
0.9.1
1.*
1.0.0
1.0.0a0
1.0.0a1
1.0.0a2
1.0.0a3
1.0.0a4
1.0.0a5
1.0.0b1
1.0.0b2
1.0.0b3
1.0.0b4
1.0.0b5
1.0.0b6
1.0.0b7
1.0.0b8
1.0.0b9
1.0.1
1.0.2
1.0.3
1.0.4
1.0.5
1.1.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-26184.json"