CVE-2022-26184: Poetry Package Untrusted Search Path Vulnerability
Summary
CVE-2022-26184: Poetry v1.1.9 and below was discovered to contain an untrusted search path which causes the application to behave in unexpected ways when users execute Poetry commands in a directory containing malicious content. Affects poetry versions < 1.1.9. Fixed in 1.1.9. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Poetry is a Python dependency management and packaging tool. It provides a simple and intuitive way to manage project dependencies and create distributable packages. The Poetry package, available on PyPI, is widely used by Python developers to streamline their development workflow. However, versions 1.1.9 and below of Poetry have been found to contain a vulnerability that allows for unexpected behavior when executing Poetry commands in a directory containing malicious content. This vulnerability specifically affects the Windows operating system.
Vulnerability Detail
The vulnerability in Poetry arises from an untrusted search path. When Poetry commands are executed in a directory containing malicious content, the application may behave in unexpected ways. This can lead to various security risks, such as arbitrary code execution or unintended modifications to the user's system. The vulnerability is present in Poetry versions 1.1.9 and below, making them susceptible to exploitation. It is important for users to update to a fixed version to mitigate the risk.
How To Fix
Latest published version: 2.5.1 as of 23 Oct 2026
pip install --upgrade "poetry==2.5.1"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.1.9
This is the first release that contains the fix.
pip install --upgrade "poetry==1.1.9"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The Poetry package versions 1.1.9 and below are vulnerable to an untrusted search path issue on Windows. This vulnerability can lead to unexpected behavior and potential security risks. Users should update to Poetry version 1.1.10 or later to mitigate the risk. Exercise caution when executing Poetry commands in directories with untrusted or potentially malicious content. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for poetry →
FAQ
You can check the version of Poetry installed on your system by running the command poetry --version in your terminal.
Yes, this vulnerability affects Poetry when running on the Windows operating system. Other operating systems are not affected.
At the time of this advisory, there are no known exploits for this vulnerability. However, it is crucial to update to a fixed version as soon as possible to prevent potential exploitation.
While waiting for the fix, it is recommended to exercise caution when executing Poetry commands in directories with untrusted or potentially malicious content. Consider using alternative methods or tools for dependency management until the vulnerability is resolved.
You can find more information about this vulnerability, including technical details and the fixed version, in the official advisory on the Python Package Advisory Database: https://github.com/pypa/advisory-database/blob/main/vulns/poetry/PYSEC-2022-234.yaml.
References
Related vulnerabilities
Recent vulnerabilities recorded for poetry.
