Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

python-poetry/poetry

              main @ f467023
            

Fixes

CVEs

CRITICAL

Peak severity

33.3%

Coverage

Highlights

Path Traversal: 3 prior fixes. Scrutinize any change in this area.

src/poetry/installation/wheel_installer.py: most-fixed (2 issues). Treat as high-risk during review.

2 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Path Traversal: Insecure handling of paths inside wheels allowed malicious archives to escape the target directory during installation, particularly on Windows where long path prefixes can bypass basic checks. This is tracked in CVE-2026-34591.

Credential Leak: Git credentials and repository authentication tokens were leaked to unauthorized hosts due to overly broad URL matching that relied on host subpaths or 'netloc' instead of strict hostname verification.

Dependency Confusion: The package solver failed to strictly respect explicit source repository configurations when resolving packages sharing identical versions across multiple registries, exposing users to dependency confusion attacks.