GitHub Advisoryadvisory · PyPI
GHSA-3936-cmfr-pm3m Black: Arbitrary file writes from unsanitized user input in cache file name
HIGH
Official page ↗
- Aliases
- CVE-2026-32274
- Ecosystem
- PyPI
- Packages
- black
- Severity
- High
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- Weaknesses
- CWE-22
- Reviewed
- 2026-03-12
Affected packages
• PyPI black: >= 24.3.0, < 26.3.1 → fixed in 26.3.1
Description
Impact
Black writes a cache file, the name of which is computed from various formatting options. The value of the `--python-cell-magics` option was placed in the filename without sanitization, which allowed an attacker who controls the value of this argument to write cache files to arbitrary file system locations.
Patches
Fixed in Black 26.3.1.
Workarounds
Do not allow untrusted user input into the value of the `--python-cell-magics` option.
Related
Alias · CVE (1)
- CVE-2026-32274 Black is the uncompromising Python code formatter. vulnerability
Weakness · CWE (1)
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness
References
- https://github.com/psf/black/security/advisories/GHSA-3936-cmfr-pm3m web
- https://nvd.nist.gov/vuln/detail/CVE-2026-32274 advisory
- https://github.com/psf/black/pull/4176 web
- https://github.com/psf/black/pull/5038 web
- https://github.com/psf/black/commit/4937fe6cf241139ddbfc16b0bdbb5b422798909d web
- https://github.com/psf/black/commit/ed770ba4dd50c419148a0fca2b43937a7447e1f9 web
- https://access.redhat.com/errata/RHSA-2026:10184 web
- https://access.redhat.com/errata/RHSA-2026:13545 web
- https://access.redhat.com/errata/RHSA-2026:13553 web
- https://access.redhat.com/security/cve/CVE-2026-32274 web
- https://bugzilla.redhat.com/show_bug.cgi?id=2447111 web
- https://github.com/psf/black package
- https://github.com/psf/black/releases/tag/26.3.1 web
- https://github.com/pypa/advisory-database/tree/main/vulns/black/PYSEC-2026-2121.yaml web
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-32274.json web