CVE-2026-32274

HIGH

Black < 26.3.1 - Path Traversal via --python-cell-magics Option

Title source: llm
STIX 2.1

Description

Black is the uncompromising Python code formatter. Starting in version 24.3.0 and prior to version 26.3.1, Black writes a cache file, the name of which is computed from various formatting options. The value of the --python-cell-magics option was placed in the filename without sanitization, which allowed an attacker who controls the value of this argument to write cache files to arbitrary file system locations. Fixed in Black 26.3.1.

References (13)

Core 13
Core References
Issue Tracking x_refsource_misc
https://github.com/psf/black/pull/5038
Release Notes x_refsource_misc
https://github.com/psf/black/releases/tag/26.3.1
X_Refsource_Misc x_refsource_misc
https://github.com/psf/black/pull/4176
Vendor Advisory x_refsource_misc
https://access.redhat.com/errata/RHSA-2026:10184
Vendor Advisory x_refsource_misc
https://access.redhat.com/errata/RHSA-2026:13545
Vendor Advisory x_refsource_misc
https://access.redhat.com/errata/RHSA-2026:13553
Vendor Advisory x_refsource_misc
https://bugzilla.redhat.com/show_bug.cgi?id=2447111

Scores

CVSS v3 7.5
EPSS 0.0062
EPSS Percentile 46.4%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Details

CWE
CWE-22
Status published
Products (4)
psf/black < 26.3.1
psf/black >= 24.3.0, < 26.3.1
pypi/black 24.3.0 - 26.3.1PyPI
python/black < 26.3.1
Published Mar 12, 2026
Tracked Since Mar 13, 2026