CVE-2026-41140
2 advisories.
PyPI/poetry CVE-2026-41140: low, EPSS 0.47%
Poetry has Path Traversal in tar extraction on Python 3.10.0 - 3.10.12 and 3.11.0 - 3.11.4
Action: Upgrade poetry to 2.3.4 or later.
pip install poetry==2.3.4Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 2.3.4 | - |
Fixed versions
| 2.3.4 |
Sources
- osv: GHSA-73h3-mf4w-8647
- https://github.com/python-poetry/poetry/security/advisories/GHSA-73h3-mf4w-8647
- https://nvd.nist.gov/vuln/detail/CVE-2026-41140
- https://github.com/python-poetry/poetry
- https://github.com/python-poetry/poetry/releases/tag/2.3.4
CVE-2026-41140 · published · modified · JSON
PyPI/poetry CVE-2026-41140: unknown, EPSS 0.47%
Poetry has Path Traversal in tar extraction on Python 3.10.0 - 3.10.12 and 3.11.0 - 3.11.4
Action: Upgrade poetry to 2.3.4 or later.
pip install poetry==2.3.4Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 2.3.4 | - |
Fixed versions
| 2.3.4 |
Sources
- osv: PYSEC-2026-2890
- https://github.com/python-poetry/poetry/security/advisories/GHSA-73h3-mf4w-8647
- https://nvd.nist.gov/vuln/detail/CVE-2026-41140
- https://github.com/python-poetry/poetry
- https://github.com/python-poetry/poetry/releases/tag/2.3.4
- https://pypi.org/project/poetry
- https://github.com/advisories/GHSA-73h3-mf4w-8647
CVE-2026-41140 · published · modified · JSON