CVE-2022-36070

CVE-2022-36070 is a critical arbitrary code execution vulnerability affecting Poetry, a Python dependency manager, specifically on Windows systems. It arises because Poetry executes Git commands by name rather than absolute path, allowing a malicious executable in the current directory to be run instead of the legitimate Git command. This can lead to system takeover, credential theft, or lateral movement within a network if a developer is exploited. The vulnerability has a CVSS score of 7.3 (HIGH), indicating a local attack vector with low attack complexity, requiring user interaction. While not remotely exploitable, it poses a significant risk to developers handling untrusted files, as the behavior is undocumented and cannot be easily vetted. Currently, there is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage. Patches are available in Poetry versions 1.1.9 and 1.2.0b1.