CVE-2026-31900 Details
Description
Black is the uncompromising Python code formatter. Black provides a GitHub action for formatting code. This action supports an option, use_pyproject: true, for reading the version of Black to use from the repository pyproject.toml. A malicious pull request could edit pyproject.toml to use a direct URL reference to a malicious repository. This could lead to arbitrary code execution in the context of the GitHub Action. Attackers could then gain access to secrets or permissions available in the context of the action. Version 26.3.0 fixes this vulnerability.
A vulnerability in the Black Python code formatter's GitHub Action allows for arbitrary code execution. This issue arises from the action's version parsing when the 'use_pyproject' option is enabled. Malicious pull requests can exploit this by directing the action to a harmful repository, potentially accessing sensitive secrets or permissions within the action's context. The vulnerability affects Black versions prior to 26.3.0.
Users should upgrade to Black version 26.3.0, which addresses the vulnerability by improving the validation of the 'version' field. This update is automatically applied when the GitHub Action is used as 'psf/black@stable'. For those using 'psf/black' with 'use_pyproject: true', it's recommended to disable this option or explicitly set the version to avoid potential exploitation.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 12, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/psf/black/commit/0a2560b981364dde4c8cf8ce9d164c40669a8611 | [email protected] | Patch |
| https://github.com/psf/black/security/advisories/GHSA-v53h-f6m7-xcgm | [email protected] | MitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| NVD-CWE-noinfo | Insufficient Information to Classify Weakness | [email protected] |
| CWE-20 | Improper Input Validation | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| python black | < 26.3.0 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 16, 2026 | Initial Analysis | [email protected] |
| Mar 11, 2026 | New CVE Received | [email protected] |