GHSA-cg8m-r9f2-5wm2

Suggest an improvement
Source
https://github.com/advisories/GHSA-cg8m-r9f2-5wm2
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-cg8m-r9f2-5wm2/GHSA-cg8m-r9f2-5wm2.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-cg8m-r9f2-5wm2
Aliases
  • CVE-2026-114134
Downstream
CGA (5)
ECHO (1)
Published
2026-10-22T16:18:57Z
Modified
2026-10-22T16:30:30Z
Severity
  • 8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
Black: GitHub Action installs unvalidated required-version from pyproject.toml
Details

Summary

The GitHub Action bundled with Black can read the version from tool.black.required-version if use_pyproject is set to True. This version is not validated and therefore can be used to execute untrusted code in the context of a victim's repository.

Details

This is similar to the previous CVE-2026-31900. The value in tool.black.required-version is accepted as the version to be installed by the action without validation.

Proof of concept

Reproduction requires a victim to use Black's GitHub Action with use_pyproject: true. The attacker would then issue a PR to the victim's repository with pyproject.toml edited so that Black points to a malicious repository.

Impact

This is a remote code execution vulnerability impacting users using the GitHub Action bundled with psf/black and using the use_pyproject: true setting.

Database specific 
{
    "cwe_ids":  [
        "CWE-829"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-10-22T16:18:57Z",
    "nvd_published_at":  null,
    "severity":  "HIGH"
}
References

Affected packages

PyPI / black

Package

Name
black
View open source insights on deps.dev
Purl
pkg:pypi/black

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
26.10.1

Affected versions

18.*
18.3a0
18.3a1
18.3a2
18.3a3
18.3a4
18.4a0
18.4a1
18.4a2
18.4a3
18.4a4
18.5b0
18.5b1
18.6b0
18.6b1
18.6b2
18.6b3
18.6b4
18.9b0
19.*
19.3b0
19.10b0
20.*
20.8b0
20.8b1
21.*
21.4b0
21.4b1
21.4b2
21.5b0
21.5b1
21.5b2
21.6b0
21.7b0
21.8b0
21.9b0
21.10b0
21.11b0
21.11b1
21.12b0
22.*
22.1.0
22.3.0
22.6.0
22.8.0
22.10.0
22.12.0
23.*
23.1a1
23.1.0
23.3.0
23.7.0
23.9.0
23.9.1
23.10.0
23.10.1
23.11.0
23.12.0
23.12.1
24.*
24.1a1
24.1.0
24.1.1
24.2.0
24.3.0
24.4.0
24.4.1
24.4.2
24.8.0
24.10.0
25.*
25.1.0
25.9.0
25.11.0
25.12.0
26.*
26.1a1
26.1.0
26.3.0
26.3.1
26.5.0
26.5.1
26.10.0

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-cg8m-r9f2-5wm2/GHSA-cg8m-r9f2-5wm2.json"