CVE-2022-26184

Katalog CVE

CVSS 9.8 · Critical EPSS 1,8%

Kerentanan Untrusted Search Path pada python-poetry poetry. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

Poetry v1.1.9 and below was discovered to contain an untrusted search path which causes the application to behave in unexpected ways when users execute Poetry commands in a directory containing malicious content. This vulnerability occurs when the application is ran on Windows OS.

Rincian

Terbit di NVD

21 Maret 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-426: Untrusted Search Path

EPSS (30 hari)

1,8% peluang dieksploitasi; lebih tinggi dari 78,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/python-poetry/poetry-core/pull/205/commits/fa9cb6f358ae840885c700f954317f34838caba7 patch · advisory pihak ketiga
• https://github.com/python-poetry/poetry/releases/tag/1.1.9 release notes · advisory pihak ketiga
• https://www.sonarsource.com/blog/securing-developer-tools-package-managers/