p PatchFirst

CVE-2026-32274

CVE-2026-32274 · Black: Arbitrary file writes from unsanitized user input in cache file name

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Black is the uncompromising Python code formatter. Starting in version 24.3.0 and prior to version 26.3.1, Black writes a cache file, the name of which is computed from various formatting options. The value of the --python-cell-magics option was placed in the filename without sanitization, which allowed an attacker who controls the value of this argument to write cache files to arbitrary file system locations. Fixed in Black 26.3.1.

CVSS 8.7 · High · EPSS 0.7% · Fix available

Published
Updated

Stack: system · python

Affected products and versions

  • black

    Versions
    • >= 24.3.0, < 26.3.1: Affected

    No fix published

  • black Debian:12

    Versions
    • 23.1.0-1
    • 23.10.0-1
    • 23.10.1-1
    • 23.11.0-1
    • 23.3.0-1
    • 23.3.0-1~exp1
    • 23.7.0-1
    • 23.9.1-1
    • 24.1.1-1
    • 24.10.0-1
    • 24.10.0-2
    • 24.10.0-3
    • 24.2.0-1
    • 24.4.0-1
    • 24.4.0-2
    • 24.4.2-1
    • 24.4.2-2
    • 24.4.2-2~0exp0
    • 24.8.0-1
    • 25.1.0-0exp
    • 25.1.0-1
    • 25.1.0-2
    • 25.1.0-3
    • 25.11.0-1
    • 25.12.0-1
    • 25.12.0-2
    • 25.9.0-1
    • 26.1.0-1
    • 26.3.1-1
    • 26.5.1-1
    • 26.5.1-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • black Debian:13

    Versions
    • 25.1.0-3
    Affected ranges
    • ECOSYSTEM: < 25.1.0-3+deb13u1

    Update to 25.1.0-3+deb13u1

  • black Debian:14

    Versions
    • 25.1.0-3
    • 25.11.0-1
    • 25.12.0-1
    • 25.12.0-2
    • 25.9.0-1
    • 26.1.0-1
    Affected ranges
    • ECOSYSTEM: < 26.3.1-1

    Update to 26.3.1-1

  • black PyPI

    Versions
    • 24.10.0
    • 24.3.0
    • 24.4.0
    • 24.4.1
    • 24.4.2
    • 24.8.0
    • 25.1.0
    • 25.11.0
    • 25.12.0
    • 25.9.0
    • 26.1.0
    • 26.1a1
    • 26.3.0
    Affected ranges
    • ECOSYSTEM: ≥ 24.3.0, < 26.3.1

    Update to 26.3.1

  • black PyPI

    Versions
    • 18.3a0
    • 18.3a1
    • 18.3a2
    • 18.3a3
    • 18.3a4
    • 18.4a0
    • 18.4a1
    • 18.4a2
    • 18.4a3
    • 18.4a4
    • 18.5b0
    • 18.5b1
    • 18.6b0
    • 18.6b1
    • 18.6b2
    • 18.6b3
    • 18.6b4
    • 18.9b0
    • 19.10b0
    • 19.3b0
    • 20.8b0
    • 20.8b1
    • 21.10b0
    • 21.11b0
    • 21.11b1
    • 21.12b0
    • 21.4b0
    • 21.4b1
    • 21.4b2
    • 21.5b0
    • 21.5b1
    • 21.5b2
    • 21.6b0
    • 21.7b0
    • 21.8b0
    • 21.9b0
    • 22.1.0
    • 22.10.0
    • 22.12.0
    • 22.3.0
    • 22.6.0
    • 22.8.0
    • 23.1.0
    • 23.10.0
    • 23.10.1
    • 23.11.0
    • 23.12.0
    • 23.12.1
    • 23.1a1
    • 23.3.0
    • 23.7.0
    • 23.9.0
    • 23.9.1
    • 24.1.0
    • 24.1.1
    • 24.10.0
    • 24.1a1
    • 24.2.0
    • 24.3.0
    • 24.4.0
    • 24.4.1
    • 24.4.2
    • 24.8.0
    • 25.1.0
    • 25.11.0
    • 25.12.0
    • 25.9.0
    • 26.1.0
    • 26.1a1
    • 26.3.0
    Affected ranges
    • ECOSYSTEM: < 26.3.1

    Update to 26.3.1

  • black Ubuntu:20.04:LTS

    Versions
    • 19.3b0-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • black Ubuntu:22.04:LTS

    Versions
    • 20.8b1-4
    • 21.4b2-3
    • 21.10b0-1
    • 21.12b0-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • black Ubuntu:24.04:LTS

    Versions
    • 23.7.0-1
    • 23.10.1-1
    • 23.11.0-1
    • 24.2.0-1ubuntu1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • black Ubuntu:25.10

    Versions
    • 25.1.0-2
    • 25.1.0-3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • black Ubuntu:26.10

    Versions
    • 26.3.1-1
    • 26.5.1-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • black Ubuntu:26.04:LTS

    Versions
    • 25.1.0-3
    • 25.9.0-1
    • 25.11.0-1
    • 25.12.0-1
    • 26.1.0-1
    • 26.1.0-1build1
    • 26.3.1-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →