https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 18:23:26 +0000 https://cve.radiocsirt.org/vuln/bdu:2026-07726 bdu:2026-07726 https://cve.radiocsirt.org/vuln/bdu:2026-07726 https://cve.radiocsirt.org/vuln/brew-poetry-cve-2026-41140 <p><strong>Affected:</strong> Homebrew: poetry</p> <p>Poetry is a dependency manager for Python. Prior to 2.3.4, the extractall() function in src/poetry/utils/helpers.py:410-426 extracts sdist tarballs without path traversal protection on Python versions where tarfile.data_filter is unavailable. Considering only Python versions which are still supported by Poetry, these are 3.10.0 - 3.10.12 and 3.11.0 - 3.11.4. This vulnerability is fixed in 2.3.4.</p> <p><strong>Affected:</strong> Homebrew: poetry</p> <p>Poetry is a dependency manager for Python. Prior to 2.3.4, the extractall() function in src/poetry/utils/helpers.py:410-426 extracts sdist tarballs without path traversal protection on Python versions where tarfile.data_filter is unavailable. Considering only Python versions which are still supported by Poetry, these are 3.10.0 - 3.10.12 and 3.11.0 - 3.11.4. This vulnerability is fixed in 2.3.4.</p> https://cve.radiocsirt.org/vuln/brew-poetry-cve-2026-41140 https://cve.radiocsirt.org/vuln/certfr-2026-avi-1094 certfr-2026-avi-1094 https://cve.radiocsirt.org/vuln/certfr-2026-avi-1094 https://cve.radiocsirt.org/vuln/euvd-2026-337259 EUVD-2026-337259 https://cve.radiocsirt.org/vuln/euvd-2026-337259 https://cve.radiocsirt.org/vuln/fkie_cve-2026-41140 <p>Poetry is a dependency manager for Python. Prior to 2.3.4, the extractall() function in src/poetry/utils/helpers.py:410-426 extracts sdist tarballs without path traversal protection on Python versions where tarfile.data_filter is unavailable. Considering only Python versions which are still supported by Poetry, these are 3.10.0 - 3.10.12 and 3.11.0 - 3.11.4. This vulnerability is fixed in 2.3.4.</p> <p>Poetry is a dependency manager for Python. Prior to 2.3.4, the extractall() function in src/poetry/utils/helpers.py:410-426 extracts sdist tarballs without path traversal protection on Python versions where tarfile.data_filter is unavailable. Considering only Python versions which are still supported by Poetry, these are 3.10.0 - 3.10.12 and 3.11.0 - 3.11.4. This vulnerability is fixed in 2.3.4.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-41140 https://cve.radiocsirt.org/vuln/ghsa-73h3-mf4w-8647 <p><strong>Affected:</strong> PyPI: poetry</p> <p>### Summary</p> <p>The `extractall()` function in `src/poetry/utils/helpers.py:410-426` extracts sdist tarballs without path traversal protection on Python versions where `tarfile.data_filter` is unavailable. Considering only Python versions which are still supported by Poetry, these are 3.10.0 - 3.10.12 and 3.11.0 - 3.11.4.</p> <p>### Impact</p> <p>Arbitrary file write (path traversal) from untrusted sdist content.</p> <p>**In practice, the impact is low** because an attacker who exploits this vulnerability can as well include arbitrary code in a `setup.py`, which will be executed when the sdist is built after tar extraction. In other words, a malicious sdist can write arbitrary files by design. However, since it is unexpected and not by design that the file write already happens during tar extraction, this is still considered a vulnerability.</p> <p>On Python 3.11.2 (Debian Bookworm default, directly tested), a crafted sdist with `../../` tar member paths writes files outside the intended extraction directory. The traversal occurs during metadata resolution (`poetry add --lock`), before the build backend is run.</p> <p>Affected Environments: - **Python 3.10.0 through 3.10.12** (inclusive): `tarfile.data_filter` absent or broken - **Python 3.11.0 through 3.11.4** (inclusive): `tarfile.data_filter` absent or broken - **Debian Bookworm**: Python 3.11.2 (default) - **Ubuntu 22.04 LTS**: Python 3.10.6 (default)</p> <p>### Patches</p> <p>Versions 2.3.4 and newer of Poetry ensure that paths are inside the target directory.</p> <p>#…</p> <p><strong>Affected:</strong> PyPI: poetry</p> <p>### Summary</p> <p>The `extractall()` function in `src/poetry/utils/helpers.py:410-426` extracts sdist tarballs without path traversal protection on Python versions where `tarfile.data_filter` is unavailable. Considering only Python versions which are still supported by Poetry, these are 3.10.0 - 3.10.12 and 3.11.0 - 3.11.4.</p> <p>### Impact</p> <p>Arbitrary file write (path traversal) from untrusted sdist content.</p> <p>**In practice, the impact is low** because an attacker who exploits this vulnerability can as well include arbitrary code in a `setup.py`, which will be executed when the sdist is built after tar extraction. In other words, a malicious sdist can write arbitrary files by design. However, since it is unexpected and not by design that the file write already happens during tar extraction, this is still considered a vulnerability.</p> <p>On Python 3.11.2 (Debian Bookworm default, directly tested), a crafted sdist with `../../` tar member paths writes files outside the intended extraction directory. The traversal occurs during metadata resolution (`poetry add --lock`), before the build backend is run.</p> <p>Affected Environments: - **Python 3.10.0 through 3.10.12** (inclusive): `tarfile.data_filter` absent or broken - **Python 3.11.0 through 3.11.4** (inclusive): `tarfile.data_filter` absent or broken - **Debian Bookworm**: Python 3.11.2 (default) - **Ubuntu 22.04 LTS**: Python 3.10.6 (default)</p> <p>### Patches</p> <p>Versions 2.3.4 and newer of Poetry ensure that paths are inside the target directory.</p> <p>#…</p> https://cve.radiocsirt.org/vuln/ghsa-73h3-mf4w-8647 https://cve.radiocsirt.org/vuln/msrc_cve-2026-41140 msrc_CVE-2026-41140 https://cve.radiocsirt.org/vuln/msrc_cve-2026-41140 https://cve.radiocsirt.org/vuln/pysec-2026-2890 <p><strong>Affected:</strong> PyPI: poetry</p> <p>### Summary</p> <p>The `extractall()` function in `src/poetry/utils/helpers.py:410-426` extracts sdist tarballs without path traversal protection on Python versions where `tarfile.data_filter` is unavailable. Considering only Python versions which are still supported by Poetry, these are 3.10.0 - 3.10.12 and 3.11.0 - 3.11.4.</p> <p>### Impact</p> <p>Arbitrary file write (path traversal) from untrusted sdist content.</p> <p>**In practice, the impact is low** because an attacker who exploits this vulnerability can as well include arbitrary code in a `setup.py`, which will be executed when the sdist is built after tar extraction. In other words, a malicious sdist can write arbitrary files by design. However, since it is unexpected and not by design that the file write already happens during tar extraction, this is still considered a vulnerability.</p> <p>On Python 3.11.2 (Debian Bookworm default, directly tested), a crafted sdist with `../../` tar member paths writes files outside the intended extraction directory. The traversal occurs during metadata resolution (`poetry add --lock`), before the build backend is run.</p> <p>Affected Environments: - **Python 3.10.0 through 3.10.12** (inclusive): `tarfile.data_filter` absent or broken - **Python 3.11.0 through 3.11.4** (inclusive): `tarfile.data_filter` absent or broken - **Debian Bookworm**: Python 3.11.2 (default) - **Ubuntu 22.04 LTS**: Python 3.10.6 (default)</p> <p>### Patches</p> <p>Versions 2.3.4 and newer of Poetry ensure that paths are inside the target directory.</p> <p>#…</p> <p><strong>Affected:</strong> PyPI: poetry</p> <p>### Summary</p> <p>The `extractall()` function in `src/poetry/utils/helpers.py:410-426` extracts sdist tarballs without path traversal protection on Python versions where `tarfile.data_filter` is unavailable. Considering only Python versions which are still supported by Poetry, these are 3.10.0 - 3.10.12 and 3.11.0 - 3.11.4.</p> <p>### Impact</p> <p>Arbitrary file write (path traversal) from untrusted sdist content.</p> <p>**In practice, the impact is low** because an attacker who exploits this vulnerability can as well include arbitrary code in a `setup.py`, which will be executed when the sdist is built after tar extraction. In other words, a malicious sdist can write arbitrary files by design. However, since it is unexpected and not by design that the file write already happens during tar extraction, this is still considered a vulnerability.</p> <p>On Python 3.11.2 (Debian Bookworm default, directly tested), a crafted sdist with `../../` tar member paths writes files outside the intended extraction directory. The traversal occurs during metadata resolution (`poetry add --lock`), before the build backend is run.</p> <p>Affected Environments: - **Python 3.10.0 through 3.10.12** (inclusive): `tarfile.data_filter` absent or broken - **Python 3.11.0 through 3.11.4** (inclusive): `tarfile.data_filter` absent or broken - **Debian Bookworm**: Python 3.11.2 (default) - **Ubuntu 22.04 LTS**: Python 3.10.6 (default)</p> <p>### Patches</p> <p>Versions 2.3.4 and newer of Poetry ensure that paths are inside the target directory.</p> <p>#…</p> https://cve.radiocsirt.org/vuln/pysec-2026-2890 https://cve.radiocsirt.org/vuln/rhsa-2026:24866 <p>axios: Axios: Server-Side Request Forgery and proxy bypass due to improper hostname normalization path-to-regexp: path-to-regexp: Denial of Service via crafted regular expressions fast-uri: fast-uri: Path traversal vulnerability allows bypass of security policies pyasn1: pyasn1: Denial of Service due to memory exhaustion from malformed RELATIVE-OID openssl: OpenSSL: Denial of Service due to NULL pointer dereference in CMS EnvelopedData processing python-dotenv: python-dotenv: Arbitrary file overwrite via symbolic link following dynaconf: jinja2: Dynaconf: Arbitrary code execution via Server-Side Template Injection Vite: Vite: Information disclosure via WebSocket connection bypasses access control vite: Vite: Information disclosure via query parameter manipulation on the development server cryptography: Cryptography: Buffer overflow via non-contiguous buffer in API Pillow: Pillow: Denial of Service via decompression bomb in FITS image processing LiteLLM: LiteLLM: Arbitrary Code Execution via bytecode rewriting poetry: Poetry: Path traversal vulnerability allows arbitrary file write via malicious package extraction starlette: Starlette: Security restriction bypass via malformed HTTP Host header</p> <p>axios: Axios: Server-Side Request Forgery and proxy bypass due to improper hostname normalization path-to-regexp: path-to-regexp: Denial of Service via crafted regular expressions fast-uri: fast-uri: Path traversal vulnerability allows bypass of security policies pyasn1: pyasn1: Denial of Service due to memory exhaustion from malformed RELATIVE-OID openssl: OpenSSL: Denial of Service due to NULL pointer dereference in CMS EnvelopedData processing python-dotenv: python-dotenv: Arbitrary file overwrite via symbolic link following dynaconf: jinja2: Dynaconf: Arbitrary code execution via Server-Side Template Injection Vite: Vite: Information disclosure via WebSocket connection bypasses access control vite: Vite: Information disclosure via query parameter manipulation on the development server cryptography: Cryptography: Buffer overflow via non-contiguous buffer in API Pillow: Pillow: Denial of Service via decompression bomb in FITS image processing LiteLLM: LiteLLM: Arbitrary Code Execution via bytecode rewriting poetry: Poetry: Path traversal vulnerability allows arbitrary file write via malicious package extraction starlette: Starlette: Security restriction bypass via malformed HTTP Host header</p> https://cve.radiocsirt.org/vuln/rhsa-2026:24866 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-41140 <p><strong>Affected:</strong> Ubuntu:22.04:LTS: poetry, Ubuntu:24.04:LTS: poetry, Ubuntu:25.10: poetry, Ubuntu:26.04:LTS: poetry</p> <p>Poetry is a dependency manager for Python. Prior to 2.3.4, the extractall() function in src/poetry/utils/helpers.py:410-426 extracts sdist tarballs without path traversal protection on Python versions where tarfile.data_filter is unavailable. Considering only Python versions which are still supported by Poetry, these are 3.10.0 - 3.10.12 and 3.11.0 - 3.11.4. This vulnerability is fixed in 2.3.4.</p> <p><strong>Affected:</strong> Ubuntu:22.04:LTS: poetry, Ubuntu:24.04:LTS: poetry, Ubuntu:25.10: poetry, Ubuntu:26.04:LTS: poetry</p> <p>Poetry is a dependency manager for Python. Prior to 2.3.4, the extractall() function in src/poetry/utils/helpers.py:410-426 extracts sdist tarballs without path traversal protection on Python versions where tarfile.data_filter is unavailable. Considering only Python versions which are still supported by Poetry, these are 3.10.0 - 3.10.12 and 3.11.0 - 3.11.4. This vulnerability is fixed in 2.3.4.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-41140