This vulnerability (CVE-2026-41140) involves improper limitation of a pathname to a restricted directory (CWE-22) in the python-poetry tool, specifically in the extractall() function. Versions of poetry prior to 2.3.4 are affected when running on certain Python versions (3.10.0 through 3.10.12 and 3.11.0 and later). The flaw allows path traversal during extraction of source distribution tarballs, potentially enabling files to be extracted outside the intended directory. The vulnerability has a low CVSS 4.0 score of 0.6 and no known active exploitation. No vendor advisory or patch information is currently available to confirm remediation status.

An attacker could exploit this vulnerability to write files outside the intended extraction directory, potentially overwriting or creating files in arbitrary locations. However, the impact is rated low due to the limited attack complexity and lack of known exploits. The vulnerability requires user interaction and privileges consistent with the user running poetry. No evidence of active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should upgrade to poetry version 2.3.4 or later once available, as the vulnerability affects versions prior to 2.3.4. Until an official fix is confirmed, exercise caution when extracting untrusted source distribution tarballs with vulnerable poetry versions.