by Kastro
Paper/Archive/CVE-2022-26184

CVE-2022-26184

mitre — Poetry v1.1.9 and below was discovered to contain an untrusted search path which causes the application to behave in unexpected ways when…

EPSS 2%CVSS 9.8
critical.is priorityof 100
45
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 79.1.791 × 2015.8No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

Poetry v1.1.9 and below was discovered to contain an untrusted search path which causes the application to behave in unexpected ways when users execute Poetry commands in a directory containing malicious content. This vulnerability occurs when the application is ran on Windows OS.

Affected

ProductAffectedFixed inSource
n/an/a–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

refgithub.com/python-poetry/poetry/releases/tag/1.1.9refgithub.com/python-poetry/poetry-core/pull/205/commits/fa9cb6f358ae840885c700f954317f34838caba7refsonarsource.com/blog/securing-developer-tools-package-managers