CVE-2022-26184
Poetry before v1.1.9 contains Untrusted Search Path
Poetry v1.1.9 and below was discovered to contain an untrusted search path which causes the application to behave in unexpected ways when users execute Poetry commands in a directory containing malicious content. This vulnerability occurs when the application is ran on Windows OS.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Poetry v1.1.9 and below was discovered to contain an untrusted search path which causes the application to behave in unexpected ways when users execute Poetry commands in a directory containing malicious content. This vulnerability occurs when the application is ran on Windows OS.
- Record
CVE-2022-26184- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-426
- Updated
- 2026-11-02
CVE List No score
Poetry v1.1.9 and below was discovered to contain an untrusted search path which causes the application to behave in unexpected ways when users execute Poetry commands in a directory containing malicious content. This vulnerability occurs when the application is ran on Windows OS.
- Record
CVE-2022-26184- Updated
- 2026-11-02
EUVDEUVD-2022-0203 No score
Poetry v1.1.9 and below was discovered to contain an untrusted search path which causes the application to behave in unexpected ways when users execute Poetry commands in a directory containing malicious content. This vulnerability occurs when the application is ran on Windows OS.
- Record
EUVD-2022-0203- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-xr2c-5w89-63pv
Poetry before v1.1.9 contains Untrusted Search Path
Poetry prior to v1.1.9 was discovered to contain an untrusted search path which causes the application to behave in unexpected ways when users execute Poetry commands in a directory containing malicious content. This vulnerability occurs when the application is ran on Windows OS.
- Record
GHSA-xr2c-5w89-63pv- CVSS 4.0
- 9.3 Critical
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-426
- Updated
- 2026-11-02
OSVGHSA-xr2c-5w89-63pv
Poetry before v1.1.9 contains Untrusted Search Path
Poetry prior to v1.1.9 was discovered to contain an untrusted search path which causes the application to behave in unexpected ways when users execute Poetry commands in a directory containing malicious content. This vulnerability occurs when the application is ran on Windows OS.
- Record
GHSA-xr2c-5w89-63pv- CVSS 4.0
- 9.3 Critical
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-426
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2022-26184
Poetry v1.1.9 and below was discovered to contain an untrusted search path which causes the application to behave in unexpected ways when users execute Poetry commands in a directory containing malicious content. This vulnerability occurs when the application is ran on Windows OS.
- Record
UBUNTU-CVE-2022-26184- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSV No score
Poetry v1.1.9 and below was discovered to contain an untrusted search path which causes the application to behave in unexpected ways when users execute Poetry commands in a directory containing malicious content. This vulnerability occurs when the application is ran on Windows OS.
- Record
CVE-2022-26184- Updated
- 2026-11-02
OSVPYSEC-2022-234 No score
Poetry v1.1.9 and below was discovered to contain an untrusted search path which causes the application to behave in unexpected ways when users execute Poetry commands in a directory containing malicious content. This vulnerability occurs when the application is ran on Windows OS.
- Record
PYSEC-2022-234- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
poetryPyPI |
before 1.1.9 | 1.1.9 |
poetryPyPI |
before 1.1.9, plus listed versions 0.1.00.10.00.10.0a00.10.0a10.10.0a2 Show 45 moreShow less0.10.0a30.10.10.10.20.10.30.11.00.11.0a00.11.0a10.11.0a20.11.0a30.11.0a40.11.10.11.20.11.30.11.40.11.50.12.00.12.0a00.12.0a10.12.0a20.12.0a30.12.0a40.12.0a50.12.10.12.100.12.110.12.120.12.130.12.140.12.150.12.160.12.170.12.20.12.30.12.40.12.50.12.60.12.70.12.80.12.90.2.00.3.00.4.00.4.0.post10.4.10.4.2 |
1.1.9 |
poetryUbuntu:22.04:LTS |
All versions, plus listed versions 1.1.11+dfsg-31.1.12+dfsg-11.1.12+dfsg-1ubuntu1 |
None known |
poetry-coreUbuntu:22.04:LTS |
All versions, plus listed versions 1.0.0-31.0.7-2 |
None known |
poetryUbuntu:24.04:LTS |
All versions, plus listed versions 1.6.1+dfsg-21.7.1+dfsg-11.8.2+dfsg-1ubuntu2 |
None known |
poetry-coreUbuntu:24.04:LTS |
All versions, plus listed versions 1.6.1-11.7.0-11.8.1-1build11.9.0-1 |
None known |
poetryUbuntu:25.10 |
All versions, plus listed versions 2.1.1+dfsg-32.1.2+dfsg-1 |
None known |
poetry-coreUbuntu:25.10 |
All versions, plus listed versions 2.1.1-32.1.2-2 |
None known |
poetryUbuntu:26.10 |
All versions, plus listed versions 2.3.2+dfsg-32.3.4-0.12.3.4-12.3.4-2 |
None known |
poetry-coreUbuntu:26.10 |
All versions, plus listed versions 2.3.1-12.3.1-2 |
None known |
poetryUbuntu:26.04:LTS |
All versions, plus listed versions 2.1.2+dfsg-12.3.2+dfsg-3 |
None known |
poetry-coreUbuntu:26.04:LTS |
All versions, plus listed versions 2.1.2-22.2.1-22.3.1-1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-26184 is a critical vulnerability (CVSS 9.8) in Python-poetry Poetry, published March 21, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.85%, the 79th percentile. Fixed in poetry 1.1.9.
References
github.com/python-poetry/poetry/releases/tag/1.1.9
sonarsource.com/blog/securing-developer-tools-package-managers
nvd.nist.gov/vuln/detail/CVE-2022-26184
Left out here: 86 versions. The JSON record has them.