CVE-2022-26184
📋 TL;DR
CVE-2022-26184 is an untrusted search path vulnerability in Poetry package manager versions 1.1.9 and below on Windows. This allows attackers to execute arbitrary code by placing malicious files in directories where Poetry commands are run. Developers using Poetry on Windows systems are primarily affected.
💻 Affected Systems
- Poetry
📦 What is this software?
Poetry by Python Poetry
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise through arbitrary code execution with the privileges of the user running Poetry commands.
Likely Case
Local privilege escalation or execution of malicious scripts when developers run Poetry in untrusted directories.
If Mitigated
No impact if users only run Poetry in trusted directories or have updated to patched versions.
🎯 Exploit Status
Exploitation requires user to run Poetry commands in a malicious directory. Public proof-of-concept exists in the GitHub commit references.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.1.10 and above
Vendor Advisory: https://github.com/python-poetry/poetry/releases/tag/1.1.9
Restart Required: No
Instructions:
1. Update Poetry using: poetry self update 2. Verify installation with: poetry --version 3. Ensure version is 1.1.10 or higher
🔧 Temporary Workarounds
Avoid untrusted directories
windowsOnly run Poetry commands in trusted directories that you control.
Use Linux/macOS for Poetry operations
allRun Poetry commands on non-Windows systems where this vulnerability does not exist.
🧯 If You Can't Patch
- Implement strict directory access controls for developers
- Monitor for suspicious Poetry command execution in unusual directories
🔍 How to Verify
Check if Vulnerable:
Check Poetry version with: poetry --version. If version is 1.1.9 or below and running on Windows, system is vulnerable.Check Version:
poetry --versionVerify Fix Applied:
Run: poetry --version and confirm version is 1.1.10 or higher.📡 Detection & Monitoring
Log Indicators:
- Poetry command execution in unusual directories
- Multiple failed Poetry operations from same user
Network Indicators:
- Unusual outbound connections following Poetry command execution
SIEM Query:
Process execution where command contains 'poetry' and parent directory is suspicious or untrusted🔗 References
- https://github.com/python-poetry/poetry-core/pull/205/commits/fa9cb6f358ae840885c700f954317f34838caba7
- https://github.com/python-poetry/poetry/releases/tag/1.1.9
- https://www.sonarsource.com/blog/securing-developer-tools-package-managers/
- https://github.com/python-poetry/poetry-core/pull/205/commits/fa9cb6f358ae840885c700f954317f34838caba7
- https://github.com/python-poetry/poetry/releases/tag/1.1.9
- https://www.sonarsource.com/blog/securing-developer-tools-package-managers/
