psf black vulnerabilities

Latest psf black CVEs

Newest publication first

1. CVE-2026-114134 Black: GitHub Action installs unvalidated required-version from pyproject.toml

   Published 2026-11-05

   High·CVSS 8.7 EPSS 0.40%

   Black is the uncompromising Python code formatter. Prior to 26.10.1, the Black GitHub Action with use_pyproject: true accepts tool.black.required-version from pyproject.toml without validating that it is a released Black version specifier. An attacker who can submit a pull reques...

2. CVE-2026-32274 Black: Arbitrary file writes from unsanitized user input in cache file name

   Published 2026-03-12

   High·CVSS 8.7 EPSS 0.69%

   Black is the uncompromising Python code formatter. Starting in version 24.3.0 and prior to version 26.3.1, Black writes a cache file, the name of which is computed from various formatting options. The value of the --python-cell-magics option was placed in the filename without san...

3. CVE-2026-31900 Black's vulnerable version parsing leads to RCE in GitHub Action

   Published 2026-03-11

   High·CVSS 8.7 EPSS 0.52%

   Black is the uncompromising Python code formatter. Black provides a GitHub action for formatting code. This action supports an option, use_pyproject: true, for reading the version of Black to use from the repository pyproject.toml. A malicious pull request could edit pyproject.to...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.