CVE-2022-36069 affecting package poetry 1.0.10-2

CVE-2022-36069 affecting package poetry 1.0.10-2. No patch is available currently...

kkt (0.1.3) potentially affected by CVE-2022-36069 via poetry (0.12.17)

poetry PYPI version 0.12.17 is affected by a known vulnerability. The following packages have a transitive dependency on poetry and may be impacted: - kkt 0.1.3 Source cves: CVE-2022-36069 Source advisory: OSV:GHSA-9XGJ-FCGF-X6MW...

CVE-2022-36069

Poetry is a dependency manager for Python. When handling dependencies that come from a Git repository instead of a registry, Poetry uses various commands, such as git clone. These commands are constructed using user input e.g. the repository URL. When building the commands, Poetry correctly avoid...

ekrhizoc (>=0.0.5, <=0.1.0), fhmake (>=2020.1.0, <=2020.1.1) +6 more potentially affected by CVE-2022-36069 via poetry (>=1.0.0, <=1.1.5)

poetry PYPI version =1.0.0, =0.0.5, =2020.1.0, =0.1.4, =5.2.0, =0.1.0, =0.1.3, =0.0.1, =0.1.4 Source cves: CVE-2022-36069 Source advisory: OSV:PYSEC-2022-266...

kkt (0.1.3) potentially affected by CVE-2022-36069 via poetry (0.12.17)

poetry PYPI version 0.12.17 is affected by a known vulnerability. The following packages have a transitive dependency on poetry and may be impacted: - kkt 0.1.3 Source cves: CVE-2022-36069 Source advisory: OSV:PYSEC-2022-266...

CVE-2022-36069

Poetry is a dependency manager for Python. When handling dependencies that come from a Git repository instead of a registry, Poetry uses various commands, such as git clone. These commands are constructed using user input e.g. the repository URL. When building the commands, Poetry correctly avoid...

ekrhizoc (>=0.0.5, <=0.1.0), fhmake (>=2020.1.0, <=2020.1.1) +6 more potentially affected by CVE-2022-36069 via poetry (>=0.12.17, <=1.1.5)

poetry PYPI version =0.12.17, =0.0.5, =2020.1.0, =0.1.3, =5.2.0, =0.1.0, =0.1.3, =0.0.1, =0.1.4 Source cves: CVE-2022-36069 Source advisory: MEND:CVE-2022-36069...

CVE-2022-36069

Poetry (Python) is affected by CVE-2022-36069 where dependency handling from Git repositories can trigger arbitrary code execution if a repository URL or input starts with a dash, causing certain commands (e.g., git clone) to be parsed as options rather than positional arguments. The root cause i...