Poetry is a dependency manager for Python. Prior to 2.3.4, the extractall() function in src/poetry/utils/helpers.py:410-426 extracts sdist tarballs without path traversal protection on Python versions where tarfile.data_filter is unavailable. Considering only Python versions which are still supported by Poetry, these are 3.10.0 - 3.10.12 and 3.11.0 - 3.11.4. This vulnerability is fixed in 2.3.4.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Poetry is a dependency manager for Python. Prior to 2.3.4, the extractall() function in     src/poetry/utils/helpers.py:410-426 extracts sdist tarballs without path traversal protection on Python     versions where tarfile.data_filter is unavailable. Considering only Python versions which are still     supported by Poetry, these are 3.10.0 - 3.10.12 and 3.11.0 - 3.11.4. This vulnerability is fixed in 2.3.4.
    (CVE-2026-41140)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Poetry is a dependency manager for Python. Prior to 2.3.4, the extractall() function in
    src/poetry/utils/helpers.py:410-426 extracts sdist tarballs without path traversal protection on Python
    versions where tarfile.data_filter is unavailable. Considering only Python versions which are still
    supported by Poetry, these are 3.10.0 - 3.10.12 and 3.11.0 - 3.11.4. This vulnerability is fixed in 2.3.4.
    (CVE-2026-41140)

ID	Name	Product	Family	Severity
310465	Linux Distros Unpatched Vulnerability : CVE-2026-41140	Nessus	Misc.	low
440721	SCA: security update for poetry (GHSA-73h3-mf4w-8647)	Tenable Cloud Security	SCA Checks	low
440721	SCA: security update for poetry (GHSA-73h3-mf4w-8647)	Tenable Self-Hosted Container Security	SCA Checks	low

Detections

Analytics

CVE-2026-41140

low

Tenable Plugins

low

low

low