CVE-2022-26184

Poetry v1.1.9 and below was discovered to contain an untrusted search path which causes the application to behave in unexpected ways when users execute Poetry commands in a directory containing malicious content. This vulnerability occurs when the application is ran on Windows OS.

• CWE-426

• https://github.com/python-poetry/poetry-core/pull/205/commits/fa9cb6f358ae840885c700f954317f34838caba7Patch, Third Party Advisory
• https://github.com/python-poetry/poetry/releases/tag/1.1.9Release Notes, Third Party Advisory
• https://www.sonarsource.com/blog/securing-developer-tools-package-managers/
• https://github.com/python-poetry/poetry-core/pull/205/commits/fa9cb6f358ae840885c700f954317f34838caba7Patch, Third Party Advisory
• https://github.com/python-poetry/poetry/releases/tag/1.1.9Release Notes, Third Party Advisory
• https://www.sonarsource.com/blog/securing-developer-tools-package-managers/

Published

Mar 21, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-26173JForum v2.8.0 was discovered to contain a Cross-Site Request…8.8
• CVE-2022-26174A remote code execution (RCE) vulnerability in Beekeeper Stu…9.8
• CVE-2022-2618Insufficient validation of untrusted input in Internals in G…6.5
• CVE-2022-26180qdPM 9.2 allows Cross-Site Request Forgery (CSRF) via the in…8.8
• CVE-2022-26181Dropbox Lepton v1.2.1-185-g2a08b77 was discovered to contain…7.8
• CVE-2022-26183PNPM v6.15.1 and below was discovered to contain an untruste…8.8
• CVE-2022-26186TOTOLINK N600R V4.3.0cu.7570_B20200620 was discovered to con…9.8
• CVE-2022-26187TOTOLINK N600R V4.3.0cu.7570_B20200620 was discovered to con…9.8
• CVE-2022-26188TOTOLINK N600R V4.3.0cu.7570_B20200620 was discovered to con…9.8
• CVE-2022-26189TOTOLINK N600R V4.3.0cu.7570_B20200620 was discovered to con…9.8
• CVE-2022-2619Insufficient validation of untrusted input in Settings in Go…4.3
• CVE-2022-26197Joget DX 7 was discovered to contain a cross-site scripting …5.4