CVE-2026-41140

Poetry 2.x prior to 2.3.4 is affected by a path-traversal in extractall() for tar archives when tarfile.data_filter is unavailable. Affected Python ranges are 3.10.0–3.10.12 and 3.11.0–3.11.4; the vulnerability could allow writing files outside the extraction directory during sdist handling in po...