# poetry (PyPI) vulnerabilities

5 known vulnerabilities (3 high, 1 low), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: 2.5.1 (Sep 20, 2026): no advisory affects it
- Newest unaffected release: 2.5.1 (Sep 20, 2026), the latest release
- Weekly downloads: 10.5M
- Dependents: 299
- Releases: 191 since 0.1.0 (Feb 28, 2018)
- Registry: https://pypi.org/project/poetry/
- Releases read: Nov 8, 2026

## Version timeline

Affected versions per advisory, in version order:

- CVE-2026-41140: 0.1.0 to 2.3.3 (2.3.4 is outside it)
- CVE-2026-34591: 1.4.0 to 2.3.2 (2.3.3 is outside it)
- CVE-2022-36069: 0.1.0 to 1.1.8 (1.1.9 is outside it)
- CVE-2022-36070: 0.1.0 to 1.1.8 (1.1.9 is outside it)
- CVE-2022-26184: 0.1.0 to 1.1.8 (1.1.9 is outside it)

## Advisories (5)

### [CVE-2026-41140](https://cve.now/CVE-2026-41140): Poetry: Path traversal in tar extraction on Python 3.10.0 - 3.10.12 and 3.11.0 - 3.11.4

- Severity: Low 0.6
- Published: Apr 24, 2026
- Affected: fixed in 2.3.4.
- Fixed in 2.3.4 (released Apr 12, 2026, 12 days before disclosure).
- The latest release, 2.5.1, is not affected.

### [CVE-2026-34591](https://cve.now/CVE-2026-34591): Poetry Has Wheel Path Traversal Which Can Lead to Arbitrary File Write

- Severity: High 7.1
- Published: Apr 2, 2026
- Affected: from 1.4.0, fixed in 2.3.3.
- Fixed in 2.3.3 (released Mar 29, 2026, 4 days before disclosure).
- The latest release, 2.5.1, is not affected.

### [CVE-2022-36069](https://cve.now/CVE-2022-36069): Poetry Argument Injection vulnerability can lead to local Code Execution

- Severity: High 7.3
- Published: Sep 7, 2022
- Affected: fixed in 1.1.9.
- Fixed in 1.1.9 (released Sep 18, 2021, 354 days before disclosure).
- The latest release, 2.5.1, is not affected.

### [CVE-2022-36070](https://cve.now/CVE-2022-36070): Poetry's Untrusted Search Path can lead to Local Code Execution on Windows

- Severity: High 7.3
- Published: Sep 7, 2022
- Affected: fixed in 1.1.9.
- Fixed in 1.1.9 (released Sep 18, 2021, 354 days before disclosure).
- The latest release, 2.5.1, is not affected.

### [CVE-2022-26184](https://cve.now/CVE-2022-26184): Poetry v1.1.9 and below was discovered to contain an untrusted search path which causes the application to behave in unexpected ways when…

- Severity: Unrated
- Published: Mar 21, 2022
- Affected: fixed in 1.1.9.
- Fixed in 1.1.9 (released Sep 18, 2021, 184 days before disclosure).
- The latest release, 2.5.1, is not affected.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/pypi/poetry
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.