# CVE-2022-26184: Poetry before v1.1.9 contains Untrusted Search Path

Source: https://junglewise.ai/threats/cve-2022-26184-poetry-before-v1-1-9-contains-untrusted-search-path  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2022-03-21  
License: CC BY 4.0 with a link back

CVE-2022-26184 · Severity: low · CVSS 3.1 · Published 2022-03-21

Poetry v1.1.9 and below was discovered to contain an untrusted search path which causes the application to behave in unexpected ways when users execute Poetry commands in a directory containing malicious content. This vulnerability occurs when the application is ran on Windows OS.

Technologies: [poetry (PyPI)](https://junglewise.ai/threats/technologies/poetry). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2022-26184 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2022-26184 being exploited in the wild.

**How severe is CVE-2022-26184?** Low severity, with a CVSS score of 3.1, published 21 March 2022.

**Which products and versions are affected?** poetry (PyPI) ECOSYSTEM:introduced=0,fixed=1.1.9.

**Is there a fix for CVE-2022-26184?** Yes. poetry (PyPI): upgrade to 1.1.9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**Am I affected by CVE-2022-26184?** Check whether you run poetry (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- poetry (PyPI): upgrade to 1.1.9 or later

  ```sh
  pip install "poetry>=1.1.9"
  ```


## Affected products

- poetry (PyPI) ECOSYSTEM:introduced=0,fixed=1.1.9

## Identifiers

- CVE-2022-26184
- GHSA-xr2c-5w89-63pv
- PYSEC-2022-234

## Related threats

- [Poetry path traversal in sdist extraction](https://junglewise.ai/threats/cve-2026-41140-poetry-path-traversal-in-sdist-extraction)
- [python-poetry Poetry path traversal in wheel installer](https://junglewise.ai/threats/cve-2026-34591-python-poetry-poetry-path-traversal-in-wheel-installer)
- [Poetry vulnerable to Untrusted Search Path leading to Local Code Execution on Windows](https://junglewise.ai/threats/cve-2022-36070-poetry-vulnerable-to-untrusted-search-path-leading-to-local-code)
- [Poetry Argument Injection can lead to Local Code Execution](https://junglewise.ai/threats/cve-2022-36069-poetry-argument-injection-can-lead-to-local-code-execution)