CVE-2026-34591

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-34591
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-34591.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-34591
Aliases
Downstream
Related
Published
2026-04-02T17:35:07.691Z
Modified
2026-07-15T01:49:21.656367504Z
Severity
  • 7.1 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Poetry Has Wheel Path Traversal Which Can Lead to Arbitrary File Write
Details

Poetry is a dependency manager for Python. From version 1.4.0 to before version 2.3.3, a crafted wheel can contain ../ paths that Poetry writes to disk without containment checks, allowing arbitrary file write with the privileges of the Poetry process. It is reachable from untrusted package artifacts during normal install flows. (Normally, installing a malicious wheel is not sufficient for execution of malicious code. Malicious code will only be executed after installation if the malicious package is imported or invoked by the user.). This issue has been patched in version 2.3.3.

Database specific 
{
    "cwe_ids": [
        "CWE-22"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34591.json",
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/python-poetry/poetry

Affected ranges

Type
GIT
Repo
https://github.com/python-poetry/poetry
Events
Introduced
0e72a55c43a993ec0258facec23416c9212964ba
Fixed
3d0151ac03b5286e557ed1518b815ad225d52cb0
Fixed
ed59537ac3709cfbdbf95d957de801c13872991a
Database specific 
{
    "cpe": "cpe:2.3:a:python-poetry:poetry:*:*:*:*:*:python:*:*",
    "extracted_events": [
        {
            "introduced": "1.4.0"
        },
        {
            "fixed": "2.3.3"
        }
    ],
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ]
}

Affected versions

1.*
1.4.0
1.5.0
1.6.0
1.7.0
1.8.0
2.*
2.0.0
2.0.1
2.1.0
2.1.1
2.1.2
2.1.3
2.2.0
2.2.1
2.3.0
2.3.1
2.3.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-34591.json"