Poetry is a dependency manager for Python. From version 1.4.0 to before version 2.3.3, a crafted wheel can contain ../ paths that Poetry writes to disk without containment checks, allowing arbitrary file write with the privileges of the Poetry process. It is reachable from untrusted package artifacts during normal install flows. (Normally, installing a malicious wheel is not sufficient for execution of malicious code. Malicious code will only be executed after installation if the malicious package is imported or invoked by the user.). This issue has been patched in version 2.3.3.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Poetry is a dependency manager for Python. From version 1.4.0 to before version 2.3.3, a crafted wheel can     contain ../ paths that Poetry writes to disk without containment checks, allowing arbitrary file write     with the privileges of the Poetry process. It is reachable from untrusted package artifacts during normal     install flows. (Normally, installing a malicious wheel is not sufficient for execution of malicious code.
    Malicious code will only be executed after installation if the malicious package is imported or invoked by     the user.). This issue has been patched in version 2.3.3. (CVE-2026-34591)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Poetry is a dependency manager for Python. From version 1.4.0 to before version 2.3.3, a crafted wheel can
    contain ../ paths that Poetry writes to disk without containment checks, allowing arbitrary file write
    with the privileges of the Poetry process. It is reachable from untrusted package artifacts during normal
    install flows. (Normally, installing a malicious wheel is not sufficient for execution of malicious code.
    Malicious code will only be executed after installation if the malicious package is imported or invoked by
    the user.). This issue has been patched in version 2.3.3. (CVE-2026-34591)

ID	Name	Product	Family	Severity
304878	Linux Distros Unpatched Vulnerability : CVE-2026-34591	Nessus	Misc.	high
439643	SCA: security update for poetry (GHSA-2599-h6xx-hpxp)	Tenable Cloud Security	SCA Checks	high
439643	SCA: security update for poetry (GHSA-2599-h6xx-hpxp)	Tenable Self-Hosted Container Security	SCA Checks	high

Detections

Analytics

CVE-2026-34591

high

Tenable Plugins

high

high

high