Lucene search
Veracode Vulnerability DatabaseVERACODE:34793HistoryMar 22, 2022 - 11:15 a.m.
Remote Code Execution (RCE)
2022-03-2211:15:15
Veracode Vulnerability Database
sca.analysiscenter.veracode.com
4
0.002 Low
EPSS
Percentile
59.3%
poetry_core is vulnerable to remote code execution. The vulnerability exists in git.py when the application runs on Windows because the file hashes are not checked before installation which allows an attacker to inject and execute poetry commands.
| CPE | Name | Operator | Version |
|---|---|---|---|
| poetry-core | eq | 1.0.0a5 | |
| poetry-core | le | 1.0.4 | |
| poetry-core | le | 1.0.0a4 | |
| poetry-core | eq | 1.0.0a5 | |
| poetry-core | le | 1.0.4 | |
| poetry-core | le | 1.0.0a4 |
Related
nvd
nvd
CVE-2022-26184
2022-03-21 22:15:08
osv
osv
PYSEC-2022-234
2022-03-21 22:15:00
CVE-2022-26184
2022-03-21 22:15:08
Poetry before v1.1.9 contains Untrusted Search Path
2022-03-23 00:00:24
prion
prion
Design/Logic Flaw
2022-03-21 22:15:00
debiancve
debiancve
CVE-2022-26184
2022-03-21 22:15:08
github
github
Poetry before v1.1.9 contains Untrusted Search Path
2022-03-23 00:00:24
cve
cve
CVE-2022-26184
2022-03-21 22:15:08
ubuntucve
ubuntucve
CVE-2022-26184
2022-03-21 00:00:00
cvelist
cvelist
CVE-2022-26184
2022-03-21 00:00:00