PyPI/poetry CVE-2026-41140: high 8.7, EPSS 0.29%
Poetry has Path Traversal in tar extraction on Python 3.10.0 - 3.10.12 and 3.11.0 - 3.11.4
Action: Upgrade poetry to 2.3.4 or later.
pip install poetry==2.3.4Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 2.3.4 | - |
Fixed versions
| 2.3.4 |
Sources
- osv: GHSA-73h3-mf4w-8647
- nvd: CVE-2026-41140
- https://github.com/python-poetry/poetry/security/advisories/GHSA-73h3-mf4w-8647
- https://github.com/python-poetry/poetry
- https://github.com/python-poetry/poetry/releases/tag/2.3.4
CVE-2026-41140 · published · modified · JSON