Exploitation Summary
EIP tracks 2 public exploits for CVE-2026-31900. PoCs published by Batosay1337Lab.
AI-analyzed exploit summary This repository provides a detailed technical analysis of CVE-2026-31900, a supply chain RCE vulnerability in the psf/black GitHub Action due to an insecure regex validation in version parsing. It includes a step-by-step breakdown of the attack vector, vulnerable regex, and mitigation steps.
Description
Black is the uncompromising Python code formatter. Black provides a GitHub action for formatting code. This action supports an option, use_pyproject: true, for reading the version of Black to use from the repository pyproject.toml. A malicious pull request could edit pyproject.toml to use a direct URL reference to a malicious repository. This could lead to arbitrary code execution in the context of the GitHub Action. Attackers could then gain access to secrets or permissions available in the context of the action. Version 26.3.0 fixes this vulnerability.
Exploits (2)
This repository provides a detailed technical analysis of CVE-2026-31900, a supply chain RCE vulnerability in the psf/black GitHub Action due to an insecure regex validation in version parsing. It includes a step-by-step breakdown of the attack vector, vulnerable regex, and mitigation steps.
This repository demonstrates CVE-2026-31900, an RCE vulnerability in the psf/black GitHub Action via pyproject.toml URL injection. The workflow file intentionally uses a vulnerable version of the Black formatter with a configuration that exposes the flaw.
References (2)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H