p PatchFirst

CVE-2026-31900

CVE-2026-31900 · Black's vulnerable version parsing leads to RCE in GitHub Action

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Black is the uncompromising Python code formatter. Black provides a GitHub action for formatting code. This action supports an option, use_pyproject: true, for reading the version of Black to use from the repository pyproject.toml. A malicious pull request could edit pyproject.toml to use a direct URL reference to a malicious repository. This could lead to arbitrary code execution in the context of the GitHub Action. Attackers could then gain access to secrets or permissions available in the context of the action. Version 26.3.0 fixes this vulnerability.

CVSS 8.7 · High · EPSS 0.7% · Fix available

Published
Updated

Stack: system · python

Affected products and versions

  • black

    Versions
    • < 26.3.0: Affected

    No fix published

  • black Debian:12

    Versions
    • 23.1.0-1
    • 23.10.0-1
    • 23.10.1-1
    • 23.11.0-1
    • 23.3.0-1
    • 23.3.0-1~exp1
    • 23.7.0-1
    • 23.9.1-1
    • 24.1.1-1
    • 24.10.0-1
    • 24.10.0-2
    • 24.10.0-3
    • 24.2.0-1
    • 24.4.0-1
    • 24.4.0-2
    • 24.4.2-1
    • 24.4.2-2
    • 24.4.2-2~0exp0
    • 24.8.0-1
    • 25.1.0-0exp
    • 25.1.0-1
    • 25.1.0-2
    • 25.1.0-3
    • 25.11.0-1
    • 25.12.0-1
    • 25.12.0-2
    • 25.9.0-1
    • 26.1.0-1
    • 26.3.1-1
    • 26.5.1-1
    • 26.5.1-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • black Debian:13

    Versions
    • 25.1.0-3
    • 25.1.0-3+deb13u1
    • 25.11.0-1
    • 25.12.0-1
    • 25.12.0-2
    • 25.9.0-1
    • 26.1.0-1
    • 26.3.1-1
    • 26.5.1-1
    • 26.5.1-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • black Debian:14

    Versions
    • 25.1.0-3
    • 25.11.0-1
    • 25.12.0-1
    • 25.12.0-2
    • 25.9.0-1
    • 26.1.0-1
    • 26.3.1-1
    • 26.5.1-1
    • 26.5.1-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • black PyPI

    Versions
    • 18.3a0
    • 18.3a1
    • 18.3a2
    • 18.3a3
    • 18.3a4
    • 18.4a0
    • 18.4a1
    • 18.4a2
    • 18.4a3
    • 18.4a4
    • 18.5b0
    • 18.5b1
    • 18.6b0
    • 18.6b1
    • 18.6b2
    • 18.6b3
    • 18.6b4
    • 18.9b0
    • 19.10b0
    • 19.3b0
    • 20.8b0
    • 20.8b1
    • 21.10b0
    • 21.11b0
    • 21.11b1
    • 21.12b0
    • 21.4b0
    • 21.4b1
    • 21.4b2
    • 21.5b0
    • 21.5b1
    • 21.5b2
    • 21.6b0
    • 21.7b0
    • 21.8b0
    • 21.9b0
    • 22.1.0
    • 22.10.0
    • 22.12.0
    • 22.3.0
    • 22.6.0
    • 22.8.0
    • 23.1.0
    • 23.10.0
    • 23.10.1
    • 23.11.0
    • 23.12.0
    • 23.12.1
    • 23.1a1
    • 23.3.0
    • 23.7.0
    • 23.9.0
    • 23.9.1
    • 24.1.0
    • 24.1.1
    • 24.10.0
    • 24.1a1
    • 24.2.0
    • 24.3.0
    • 24.4.0
    • 24.4.1
    • 24.4.2
    • 24.8.0
    • 25.1.0
    • 25.11.0
    • 25.12.0
    • 25.9.0
    • 26.1.0
    • 26.1a1
    Affected ranges
    • ECOSYSTEM: < 26.3.0

    Update to 26.3.0

  • black Ubuntu:20.04:LTS

    Versions
    • 19.3b0-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • black Ubuntu:22.04:LTS

    Versions
    • 20.8b1-4
    • 21.4b2-3
    • 21.10b0-1
    • 21.12b0-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • black Ubuntu:24.04:LTS

    Versions
    • 23.7.0-1
    • 23.10.1-1
    • 23.11.0-1
    • 24.2.0-1ubuntu1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • black Ubuntu:25.10

    Versions
    • 25.1.0-2
    • 25.1.0-3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • black Ubuntu:26.10

    Versions
    • 26.3.1-1
    • 26.5.1-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • black Ubuntu:26.04:LTS

    Versions
    • 25.1.0-3
    • 25.9.0-1
    • 25.11.0-1
    • 25.12.0-1
    • 26.1.0-1
    • 26.1.0-1build1
    • 26.3.1-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →