Poetry CVE-2026-41140

Exploitation requires all of the following: (1) Poetry version prior to 2.3.4 installed and active; (2) Python version 3.10.0 through 3.10.12 or 3.11.0 through 3.11.4 running Poetry; (3) a crafted source distribution (sdist) with tar members containing path traversal sequences (e.g., ../../), symlinks pointing outside the extraction directory, or hardlinks targeting external files; (4) execution of a Poetry command that triggers tar extraction, specifically poetry add <malicious-package> (during dependency resolution) or poetry install with an sdist in the lock file. The exploitation is not automatically triggered during normal package installation from pre-built wheels (which do not invoke extractall()) and requires the presence of PKG-INFO metadata that lacks Requires-Dist fields, forcing Poetry to extract and inspect the sdist for dependency information. The attacker has no privileges requirement-exploitation works against default Poetry installations and configurations with no elevated permissions needed.

Despite a missing CVSS vector and score, this vulnerability carries moderate real-world risk when contextualized against available signals. The vulnerability requires three converging conditions: (1) a vulnerable Poetry version on an affected Python version, (2) dependency resolution or installation of a malicious sdist, and (3) network exposure during poetry add or poetry lock operations. The attack vector is network-adjacent (the attacker must craft and distribute a malicious sdist), but once a user attempts to add or lock dependencies, extraction occurs automatically without user interaction beyond normal Poetry commands. The vendor's own assessment states 'impact is low in practice' because a malicious sdist can already execute arbitrary code via setup.py during the build phase; however, the vulnerability enables file writes during tar extraction before the build backend runs, which is unexpected and violates least-privilege extraction semantics. No EPSS or KEV status is available, so exploitation probability cannot be quantified from official sources. The suggested patch (path validation with resolve() and is_relative_to() checks) is straightforward and has low implementation complexity, suggesting exploitation was not hardened by design complexity but rather by oversight. The scope is limited to specific Python minor versions, reducing affected population compared to a universal vulnerability. Organizations using affected configurations (Poetry + Python 3.10.0-3.10.12 or 3.11.0-3.11.4) should prioritize upgrading Poetry to 2.3.4 or later, but the urgency is moderate rather than critical, as the attack requires distribution and installation of a malicious package.

An attacker publishes a malicious Python package to PyPI (or a private index) with a source distribution containing a crafted tarball with members named ../../etc/passwd or similar path traversal sequences. When a developer or CI/CD system runs poetry add malicious-package on a system with Poetry < 2.3.4 and Python 3.10.0-3.10.12 or 3.11.0-3.11.4, Poetry's dependency resolver extracts the sdist to inspect metadata. The unvalidated tar extraction writes files outside the package directory, potentially overwriting system files, injecting code into sibling projects, or poisoning the developer's environment before setup.py even runs.