CVE-2022-36070: Poetry vulnerable to Untrusted Search Path leading to Local Code Execution on Windows
Summary
CVE-2022-36070: Poetry vulnerable to Untrusted Search Path leading to Local Code Execution on Windows. Affects poetry versions < 1.1.9. Fixed in 1.1.9. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Poetry is a package manager for Python that helps developers manage project dependencies and packaging. It provides a command-line interface and a configuration file to define project settings and dependencies. Poetry allows developers to specify dependencies from Git repositories, which are handled by executing various commands. However, Poetry's handling of these commands can lead to the execution of untrusted code on Windows systems.
Vulnerability Detail
The vulnerability arises from the way Poetry calls executables by name when handling dependencies from Git. On Windows, the operating system searches for executables in the current directory first before looking in the paths defined in the PATH environment variable. This behavior can be exploited if a malicious file named git.exe is present in the current directory. When Poetry executes a command like git config, it may inadvertently execute the malicious git.exe instead of the intended executable. This can result in arbitrary code execution, allowing an attacker to take control of the system. The impact of this vulnerability includes the potential theft of credentials, persistence of access, and the ability to launch further attacks on internal systems.
How To Fix
Latest published version: 2.5.1 as of 23 Oct 2026
pip install --upgrade "poetry==2.5.1"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.1.9
This is the first release that contains the fix.
pip install --upgrade "poetry==1.1.9"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to upgrade to the patched versions of Poetry to mitigate the risk of local code execution.
Conclusion
The vulnerability in Poetry can lead to local code execution on Windows systems, potentially resulting in the takeover of the system and unauthorized access. It is important for developers to upgrade to the patched versions of Poetry (1.1.9 or 1.2.0b1) to mitigate this risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for poetry →
FAQ
Poetry is a package manager for Python that helps developers manage project dependencies and packaging.
The vulnerability arises from the way Poetry calls executables by name when handling dependencies from Git. This can lead to the execution of untrusted code if a malicious file is present in the current directory.
The vulnerability can result in arbitrary code execution, allowing an attacker to take control of the system. This can lead to the theft of credentials, persistence of access, and further attacks on internal systems.
To fix this vulnerability, it is recommended to upgrade to version 1.1.9 or 1.2.0b1 of Poetry, which include a patch for the issue.
There is no known workaround for this vulnerability. It is crucial to upgrade to the patched versions of Poetry to mitigate the risk of local code execution.
References
Related vulnerabilities
Recent vulnerabilities recorded for poetry.
