What’s Vulnerable › Vulnerabilities

CVE-2026-32274: Black: Arbitrary file writes from unsanitized user input in cache file name

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-03-12 · updated 2026-08-03
• Weakness: CWE-22

Description

Black is the uncompromising Python code formatter. Starting in version 24.3.0 and prior to version 26.3.1, Black writes a cache file, the name of which is computed from various formatting options. The value of the --python-cell-magics option was placed in the filename without sanitization, which allowed an attacker who controls the value of this argument to write cache files to arbitrary file system locations. Fixed in Black 26.3.1.

Affected products

• psf black: before 26.3.1 — fixed in 26.3.1

How to fix

Upgrade to a fixed version: psf black 26.3.1. Check the vendor advisory for mitigations.

References

• https://access.redhat.com/errata/RHSA-2026:10184
• https://access.redhat.com/errata/RHSA-2026:13545
• https://access.redhat.com/errata/RHSA-2026:13553
• https://access.redhat.com/security/cve/CVE-2026-32274
• https://bugzilla.redhat.com/show_bug.cgi?id=2447111
• https://github.com/psf/black/commit/4937fe6cf241139ddbfc16b0bdbb5b422798909d
• https://github.com/psf/black/commit/ed770ba4dd50c419148a0fca2b43937a7447e1f9
• https://github.com/psf/black/pull/4176
• https://github.com/psf/black/pull/5038
• https://github.com/psf/black/releases/tag/26.3.1
• https://github.com/psf/black/security/advisories/GHSA-3936-cmfr-pm3m
• https://github.com/pypa/advisory-database/tree/main/vulns/black/PYSEC-2026-2121.yaml

Get alerted when CVE-2026-32274 or the next vulnerability affects your stack