Black: Arbitrary file writes from unsanitized user input in cache file name
### Impact Black writes a cache file, the name of which is computed from various formatting options. The value of the `--python-cell-magics` option was placed in the filename without sanitization, which allowed an attacker who controls the value of this argument to write cache files to arbitrary file system locations. ### Patches Fixed in Black 26.3.1. ### Workarounds Do not allow untrusted user input into the value of the `--python-cell-magics` option.
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-32274US | high7.5 | — | ||
Black is the uncompromising Python code formatter. Starting in version 24.3.0 and prior to version 26.3.1, Black writes a cache file, the name of which is computed from various for… | ||||
references
External citations — patches, advisories, analysis.
- https://access.redhat.com/errata/RHSA-2026:10184WEB
- https://access.redhat.com/errata/RHSA-2026:13545WEB
- https://access.redhat.com/errata/RHSA-2026:13553WEB
- https://access.redhat.com/security/cve/CVE-2026-32274WEB
- https://bugzilla.redhat.com/show_bug.cgi?id=2447111WEB
- https://github.com/psf/blackPACKAGE
- https://github.com/psf/black/commit/4937fe6cf241139ddbfc16b0bdbb5b422798909dWEB
- https://github.com/psf/black/commit/ed770ba4dd50c419148a0fca2b43937a7447e1f9WEB
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan