CVE-2026-34591
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk38th percentile - higher than 38% of all known CVEs
Summary
Poetry, a dependency manager for Python, from version 1.4.0 to before 2.3.3 allows arbitrary file write via a crafted wheel containing ../ paths. The attack is reachable during normal package install flows.
Risk Assessment
The risk is the possibility of overwriting critical system or application files, potentially leading to code execution or privilege escalation.
Recommendation
It is recommended to update Poetry to version 2.3.3 or later.
Original NVD description (English source)
Poetry is a dependency manager for Python. From version 1.4.0 to before version 2.3.3, a crafted wheel can contain ../ paths that Poetry writes to disk without containment checks, allowing arbitrary file write with the privileges of the Poetry process. It is reachable from untrusted package artifacts during normal install flows. (Normally, installing a malicious wheel is not sufficient for execution of malicious code. Malicious code will only be executed after installation if the malicious package is imported or invoked by the user.). This issue has been patched in version 2.3.3.