CVE-2026-32274 Details
Description
Black is the uncompromising Python code formatter. Starting in version 24.3.0 and prior to version 26.3.1, Black writes a cache file, the name of which is computed from various formatting options. The value of the --python-cell-magics option was placed in the filename without sanitization, which allowed an attacker who controls the value of this argument to write cache files to arbitrary file system locations. Fixed in Black 26.3.1.
A vulnerability in the Black Python code formatter prior to version 26.3.1 allows for arbitrary file writes. The issue arises because the formatter generates cache file names based on various formatting options, including the `--python-cell-magics` option. This value was incorporated into the filename without proper sanitization, enabling an attacker to manipulate the argument and write cache files to unintended locations on the file system.
Users should update to Black version 26.3.1, which hashes the components derived from `--python-cell-magics` to prevent custom magic names from affecting cache file paths. Instructions for downloading Black 26.3.1 are available on the Black GitHub releases page.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 13, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | redhat-SADP |
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| python black | < 26.3.1 |
CPE
Remediation
| |
Change History
7 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 3, 2026 | CVE Modified | [email protected] |
| Jul 15, 2026 | CVE Modified | redhat-SADP |
| Jun 30, 2026 | CVE Modified | redhat-SADP |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Mar 18, 2026 | Initial Analysis | [email protected] |
| Mar 12, 2026 | New CVE Received | [email protected] |