Intel

AIKIDO-2026-10940

poetry is vulnerable to Supply Chain Integrity Issue

Supply Chain Integrity Issue Pre-CVE
Found by Aikido Intel before public disclosure or CVE publication.
Published Yesterday

59

Medium Risk

This Affects:

PYTHONpoetry
1.2.0 - 2.3.4
Fixed in 2.4.0
Are you affected? Scan for Free

TL;DR

When poetry publish --build runs, a failing build step does not stop the publish flow in affected versions. If older wheels or sdists are already present in the configured dist/ directory, Poetry continues and uploads those stale artifacts to the target repository. Maintainers and CI pipelines that rely on --build to publish freshly built output can therefore release unintended package contents, breaking artifact integrity for downstream consumers. The fix propagates the build command exit code and aborts publishing when the build fails.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range.

Background info

poetry is vulnerable to Supply Chain Integrity Issue in versions 1.2.0 - 2.3.4.

How to fix this

Upgrade the poetry library to the patch version.