CVE-2026-32274

Black is the uncompromising Python code formatter. Prior to 26.3.1, Black writes a cache file, the name of which is computed from various formatting options. The value of the --python-cell-magics option was placed in the filename without sanitization, which allowed an attacker who controls the value of this argument to write cache files to arbitrary file system locations. Fixed in Black 26.3.1.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/psf/black/commit/4937fe6cf241139ddbfc16b0bdbb5b422798909d	Patch
https://github.com/psf/black/pull/5038	Issue Tracking Patch
https://github.com/psf/black/releases/tag/26.3.1	Release Notes
https://github.com/psf/black/security/advisories/GHSA-3936-cmfr-pm3m	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:python:black:*:*:*:*:*:python:*:*

History

No history.

Information

Published : 2026-03-12 20:16

Updated : 2026-03-18 14:12

NVD link : CVE-2026-32274

Mitre link : CVE-2026-32274

CVE.ORG link : CVE-2026-32274

JSON object : View

Products Affected

python

black

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

{"id": "CVE-2026-32274", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "published": "2026-03-12T20:16:06.350", "references": [{"url": "https://github.com/psf/black/commit/4937fe6cf241139ddbfc16b0bdbb5b422798909d", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/psf/black/pull/5038", "tags": ["Issue Tracking", "Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/psf/black/releases/tag/26.3.1", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/psf/black/security/advisories/GHSA-3936-cmfr-pm3m", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "Black is the uncompromising Python code formatter. Prior to 26.3.1, Black writes a cache file, the name of which is computed from various formatting options. The value of the --python-cell-magics option was placed in the filename without sanitization, which allowed an attacker who controls the value of this argument to write cache files to arbitrary file system locations. Fixed in Black 26.3.1."}, {"lang": "es", "value": "Black es el formateador de c\u00f3digo Python intransigente. Antes de la versi\u00f3n 26.3.1, Black escribe un archivo de cach\u00e9, cuyo nombre se calcula a partir de varias opciones de formato. El valor de la opci\u00f3n --python-cell-magics se colocaba en el nombre del archivo sin sanitizaci\u00f3n, lo que permit\u00eda a un atacante que controla el valor de este argumento escribir archivos de cach\u00e9 en ubicaciones arbitrarias del sistema de archivos. Corregido en Black 26.3.1."}], "lastModified": "2026-03-18T14:12:39.793", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:python:black:*:*:*:*:*:python:*:*", "vulnerable": true, "matchCriteriaId": "FB28127C-B646-45A8-AD1B-077310486F5F", "versionEndExcluding": "26.3.1"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}