Affected: Homebrew: poetry

Poetry is a dependency manager for Python. Prior to 2.3.4, the extractall() function in src/poetry/utils/helpers.py:410-426 extracts sdist tarballs without path traversal protection on Python versions where tarfile.data_filter is unavailable. Considering only Python versions which are still supported by Poetry, these are 3.10.0 - 3.10.12 and 3.11.0 - 3.11.4. This vulnerability is fixed in 2.3.4.

Poetry is a dependency manager for Python. Prior to 2.3.4, the extractall() function in src/poetry/utils/helpers.py:410-426 extracts sdist tarballs without path traversal protection on Python versions where tarfile.data_filter is unavailable. Considering only Python versions which are still supported by Poetry, these are 3.10.0 - 3.10.12 and 3.11.0 - 3.11.4. This vulnerability is fixed in 2.3.4.

Affected: PyPI: poetry

### Summary

The `extractall()` function in `src/poetry/utils/helpers.py:410-426` extracts sdist tarballs without path traversal protection on Python versions where `tarfile.data_filter` is unavailable. Considering only Python versions which are still supported by Poetry, these are 3.10.0 - 3.10.12 and 3.11.0 - 3.11.4.

### Impact

Arbitrary file write (path traversal) from untrusted sdist content.

**In practice, the impact is low** because an attacker who exploits this vulnerability can as well include arbitrary code in a `setup.py`, which will be executed when the sdist is built after tar extraction. In other words, a malicious sdist can write arbitrary files by design. However, since it is unexpected and not by design that the file write already happens during tar extraction, this is still considered a vulnerability.

On Python 3.11.2 (Debian Bookworm default, directly tested), a crafted sdist with `../../` tar member paths writes files outside the intended extraction directory. The traversal occurs during metadata resolution (`poetry add --lock`), before the build backend is run.

Affected Environments: - **Python 3.10.0 through 3.10.12** (inclusive): `tarfile.data_filter` absent or broken - **Python 3.11.0 through 3.11.4** (inclusive): `tarfile.data_filter` absent or broken - **Debian Bookworm**: Python 3.11.2 (default) - **Ubuntu 22.04 LTS**: Python 3.10.6 (default)

### Patches

Versions 2.3.4 and newer of Poetry ensure that paths are inside the target directory.

#…

Affected: PyPI: poetry

### Summary

The `extractall()` function in `src/poetry/utils/helpers.py:410-426` extracts sdist tarballs without path traversal protection on Python versions where `tarfile.data_filter` is unavailable. Considering only Python versions which are still supported by Poetry, these are 3.10.0 - 3.10.12 and 3.11.0 - 3.11.4.

### Impact

Arbitrary file write (path traversal) from untrusted sdist content.

**In practice, the impact is low** because an attacker who exploits this vulnerability can as well include arbitrary code in a `setup.py`, which will be executed when the sdist is built after tar extraction. In other words, a malicious sdist can write arbitrary files by design. However, since it is unexpected and not by design that the file write already happens during tar extraction, this is still considered a vulnerability.

On Python 3.11.2 (Debian Bookworm default, directly tested), a crafted sdist with `../../` tar member paths writes files outside the intended extraction directory. The traversal occurs during metadata resolution (`poetry add --lock`), before the build backend is run.

Affected Environments: - **Python 3.10.0 through 3.10.12** (inclusive): `tarfile.data_filter` absent or broken - **Python 3.11.0 through 3.11.4** (inclusive): `tarfile.data_filter` absent or broken - **Debian Bookworm**: Python 3.11.2 (default) - **Ubuntu 22.04 LTS**: Python 3.10.6 (default)

### Patches

Versions 2.3.4 and newer of Poetry ensure that paths are inside the target directory.

#…

axios: Axios: Server-Side Request Forgery and proxy bypass due to improper hostname normalization path-to-regexp: path-to-regexp: Denial of Service via crafted regular expressions fast-uri: fast-uri: Path traversal vulnerability allows bypass of security policies pyasn1: pyasn1: Denial of Service due to memory exhaustion from malformed RELATIVE-OID openssl: OpenSSL: Denial of Service due to NULL pointer dereference in CMS EnvelopedData processing python-dotenv: python-dotenv: Arbitrary file overwrite via symbolic link following dynaconf: jinja2: Dynaconf: Arbitrary code execution via Server-Side Template Injection Vite: Vite: Information disclosure via WebSocket connection bypasses access control vite: Vite: Information disclosure via query parameter manipulation on the development server cryptography: Cryptography: Buffer overflow via non-contiguous buffer in API Pillow: Pillow: Denial of Service via decompression bomb in FITS image processing LiteLLM: LiteLLM: Arbitrary Code Execution via bytecode rewriting poetry: Poetry: Path traversal vulnerability allows arbitrary file write via malicious package extraction starlette: Starlette: Security restriction bypass via malformed HTTP Host header

Affected: Ubuntu:22.04:LTS: poetry, Ubuntu:24.04:LTS: poetry, Ubuntu:25.10: poetry, Ubuntu:26.04:LTS: poetry

Poetry is a dependency manager for Python. Prior to 2.3.4, the extractall() function in src/poetry/utils/helpers.py:410-426 extracts sdist tarballs without path traversal protection on Python versions where tarfile.data_filter is unavailable. Considering only Python versions which are still supported by Poetry, these are 3.10.0 - 3.10.12 and 3.11.0 - 3.11.4. This vulnerability is fixed in 2.3.4.