{"action":"Upgrade poetry to 1.1.9 or later.","affected":[{"fixed":"1.1.9","introduced":"0"}],"component":"poetry","cve_ids":["CVE-2022-36070"],"ecosystem":"PyPI","epss":0.00362,"exploited":false,"fixed_versions":["1.1.9"],"ghsa_id":"GHSA-j4j9-7hg9-97g6","id":"tcs_01M5KGHWGK3C5KQC44AA4ERS3Q","modified_at":"2026-06-10T17:14:17.620107666Z","published_at":"2022-09-07T19:15:08Z","references":["https://osv.dev/vulnerability/PYSEC-2022-43179","https://github.com/python-poetry/poetry/security/advisories/GHSA-j4j9-7hg9-97g6","https://github.com/python-poetry/poetry/releases/tag/1.1.9","https://github.com/python-poetry/poetry/releases/tag/1.2.0b1","https://github.com/advisories/GHSA-j4j9-7hg9-97g6"],"severity":{"label":"high","score":7.3},"sources":[{"source":"osv","source_id":"PYSEC-2022-43179","url":"https://osv.dev/vulnerability/PYSEC-2022-43179"}],"summary":"Poetry is a dependency manager for Python. To handle dependencies that come from a Git repository, Poetry executes various commands, e.g. `git config`. These commands are being executed using the exec"}