Threats tagged 'brew-poetry-cve-2026-102938'

A vulnerability in Poetry's virtualenv handling allows crafted prompt values containing line boundaries to inject additional configuration lines into the pyvenv.cfg file. This can overwrite critical configuration keys such as 'home', which tooling uses to locate the base interpreter. The issue arises because pyvenv.cfg is line-based with no escape syntax, and the write operation did not sanitize line boundaries, allowing injection of arbitrary config lines. This can lead to configuration corruption or redirection of interpreter paths when the prompt value is influenced by external input such as CI job templates or environment variables. Fixed in Poetry versions 1.2.2_1 and 2.5.0 by collapsing line boundaries to spaces during serialization.