DEBIAN-CVE-2026-34591

See a problem?
Please try reporting it to the source first.
Source
https://security-tracker.debian.org/tracker/CVE-2026-34591
Import Source
https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-34591.json
JSON Data
https://api.osv.dev/v1/vulns/DEBIAN-CVE-2026-34591
Upstream
  • CVE-2026-34591
Published
2026-04-02T18:16:31.163Z
Modified
2026-04-28T20:31:41.779172Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N CVSS Calculator
Summary
[none]
Details

Poetry is a dependency manager for Python. From version 1.4.0 to before version 2.3.3, a crafted wheel can contain ../ paths that Poetry writes to disk without containment checks, allowing arbitrary file write with the privileges of the Poetry process. It is reachable from untrusted package artifacts during normal install flows. (Normally, installing a malicious wheel is not sufficient for execution of malicious code. Malicious code will only be executed after installation if the malicious package is imported or invoked by the user.). This issue has been patched in version 2.3.3.

References

Affected packages

Debian:12 / poetry

Package

Name
poetry
Purl
pkg:deb/debian/poetry?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

1.*
1.3.2+dfsg-3
1.3.2+dfsg-4
1.3.2+dfsg-5
1.5.1+dfsg-1
1.5.1+dfsg-2
1.5.1+dfsg-3
1.5.1+dfsg-4
1.6.1+dfsg-1
1.6.1+dfsg-2
1.7.1+dfsg-1
1.8.0.dev0~git20240220.cff4d7d5+dfsg-1
1.8.0.dev0~git20240220.cff4d7d5+dfsg-2
1.8.2+dfsg-1
1.8.3+dfsg-1
1.8.3+dfsg-2
1.8.3+dfsg-3
1.8.3+dfsg-4
2.*
2.0.1+dfsg-1
2.1.1+dfsg-1
2.1.1+dfsg-2
2.1.1+dfsg-3
2.1.2+dfsg-1
2.2.1+dfsg-1
2.2.1+dfsg-2
2.2.1+dfsg-3
2.3.2+dfsg-1
2.3.2+dfsg-2
2.3.2+dfsg-3

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-34591.json"

Debian:13 / poetry

Package

Name
poetry
Purl
pkg:deb/debian/poetry?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

2.*
2.1.2+dfsg-1
2.2.1+dfsg-1
2.2.1+dfsg-2
2.2.1+dfsg-3
2.3.2+dfsg-1
2.3.2+dfsg-2
2.3.2+dfsg-3

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-34591.json"

Debian:14 / poetry

Package

Name
poetry
Purl
pkg:deb/debian/poetry?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

2.*
2.1.2+dfsg-1
2.2.1+dfsg-1
2.2.1+dfsg-2
2.2.1+dfsg-3
2.3.2+dfsg-1
2.3.2+dfsg-2
2.3.2+dfsg-3

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-34591.json"