CVE-2026-32274
Black: Arbitrary file writes from unsanitized user input in cache file name
Black is the uncompromising Python code formatter. Starting in version 24.3.0 and prior to version 26.3.1, Black writes a cache file, the name of which is computed from various formatting options. The value of the --python-cell-magics option was placed in the filename without sanitization, which allowed an attacker who controls the value of this argument to write cache files to arbitrary file system locations. Fixed in Black 26.3.1.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Black: Arbitrary file writes from unsanitized user input in cache file name
Black is the uncompromising Python code formatter. Starting in version 24.3.0 and prior to version 26.3.1, Black writes a cache file, the name of which is computed from various formatting options. The value of the --python-cell-magics option was placed in the filename without sanitization, which allowed an attacker who controls the value of this argument to write cache files to arbitrary file system locations. Fixed in Black 26.3.1.
- Record
CVE-2026-32274- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-22, CWE-22
- Updated
- 2026-11-02
EUVDEUVD-2026-11698
Black is the uncompromising Python code formatter. Starting in version 24.3.0 and prior to version 26.3.1, Black writes a cache file, the name of which is computed from various formatting options. The value of the --python-cell-magics option was placed in the filename without sanitization, which allowed an attacker who controls the value of this argument to write cache files to arbitrary file system locations. Fixed in Black 26.3.1.
- Record
EUVD-2026-11698- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-3936-cmfr-pm3m
Black: Arbitrary file writes from unsanitized user input in cache file name
Impact
Black writes a cache file, the name of which is computed from various formatting options. The value of the --python-cell-magics option was placed in the filename without sanitization, which allowed an attacker who controls the value of this argument to write cache files to arbitrary file system locations.
Patches
Fixed in Black 26.3.1.
Workarounds
Do not allow untrusted user input into the value of the --python-cell-magics option.
- Record
GHSA-3936-cmfr-pm3m- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
NVD
Black is the uncompromising Python code formatter. Starting in version 24.3.0 and prior to version 26.3.1, Black writes a cache file, the name of which is computed from various formatting options. The value of the --python-cell-magics option was placed in the filename without sanitization, which allowed an attacker who controls the value of this argument to write cache files to arbitrary file system locations. Fixed in Black 26.3.1.
- Record
CVE-2026-32274- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
OSV
Black: Arbitrary file writes from unsanitized user input in cache file name
Black is the uncompromising Python code formatter. Starting in version 24.3.0 and prior to version 26.3.1, Black writes a cache file, the name of which is computed from various formatting options. The value of the --python-cell-magics option was placed in the filename without sanitization, which allowed an attacker who controls the value of this argument to write cache files to arbitrary file system locations. Fixed in Black 26.3.1.
- Record
CVE-2026-32274- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-22
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-32274
Black is the uncompromising Python code formatter. Starting in version 24.3.0 and prior to version 26.3.1, Black writes a cache file, the name of which is computed from various formatting options. The value of the --python-cell-magics option was placed in the filename without sanitization, which allowed an attacker who controls the value of this argument to write cache files to arbitrary file system locations. Fixed in Black 26.3.1.
- Record
DEBIAN-CVE-2026-32274- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
Show 10 moreShow less
OSVGHSA-3936-cmfr-pm3m
Black: Arbitrary file writes from unsanitized user input in cache file name
Impact
Black writes a cache file, the name of which is computed from various formatting options. The value of the --python-cell-magics option was placed in the filename without sanitization, which allowed an attacker who controls the value of this argument to write cache files to arbitrary file system locations.
Patches
Fixed in Black 26.3.1.
Workarounds
Do not allow untrusted user input into the value of the --python-cell-magics option.
- Record
GHSA-3936-cmfr-pm3m- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
OSVOESA-2026-4064
python-black security update
The uncompromising code formatter
Security Fix(es):
Black is the uncompromising Python code formatter. Starting in version 24.3.0 and prior to version 26.3.1, Black writes a cache file, the name of which is computed from various formatting options. The value of the --python-cell-magics option was placed in the filename without sanitization, which allowed an attacker who controls the value of this argument to write cache files to arbitrary file system locations. Fixed in Black 26.3.1.(CVE-2026-32274)
- Record
OESA-2026-4064- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVPYSEC-2026-2121
Black is the uncompromising Python code formatter. Prior to 26.3.1, Black writes a cache file, the name of which is computed from various formatting options. The value of the --python-cell-magics option was placed in the filename without sanitization, which allowed an attacker who controls the value of this argument to write cache files to arbitrary file system locations. Fixed in Black 26.3.1.
- Record
PYSEC-2026-2121- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVROOT-APP-PYPI-CVE-2026-32274
CVE-2026-32274 in black - Patched by Root
Root has patched CVE-2026-32274 in the black package for Root:PyPI. Multiple fixed versions available.
- Record
ROOT-APP-PYPI-CVE-2026-32274- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-32274
Black is the uncompromising Python code formatter. Starting in version 24.3.0 and prior to version 26.3.1, Black writes a cache file, the name of which is computed from various formatting options. The value of the --python-cell-magics option was placed in the filename without sanitization, which allowed an attacker who controls the value of this argument to write cache files to arbitrary file system locations. Fixed in Black 26.3.1.
- Record
UBUNTU-CVE-2026-32274- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVopenSUSE-SU-2026:10372-1 No score
python311-black-26.3.1-1.1 on GA media
These are all security issues fixed in the python311-black-26.3.1-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:10372-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:11856-1 No score
ansible-lint-26.9.0-1.1 on GA media
These are all security issues fixed in the ansible-lint-26.9.0-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:11856-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:20417-1 No score
Security update for python-black
This update for python-black fixes the following issues:
- CVE-2026-31900: a malicious pyproject.toml edit can lead to arbitrary code execution (bsc#1259546).
- CVE-2026-32274: arbitrary file writes from unsanitized user input in cache file name (bsc#1259608).
- Record
openSUSE-SU-2026:20417-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:0900-1 No score
Security update for python-black
This update for python-black fixes the following issue:
- CVE-2026-32274: arbitrary file writes from unsanitized user input in cache file name (bsc#1259608).
- Record
SUSE-SU-2026:0900-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:20928-1 No score
Security update for python-black
This update for python-black fixes the following issues:
- CVE-2026-31900: a malicious pyproject.toml edit can lead to arbitrary code execution (bsc#1259546).
- CVE-2026-32274: arbitrary file writes from unsanitized user input in cache file name (bsc#1259608).
- Record
SUSE-SU-2026:20928-1- Updated
- 2026-11-02
Affected products
- psf black
- python black
- red hat openshift lightspeed
- red hat ansible automation platform 2
- red hat ansible automation platform 2.5
- red hat ansible automation platform 2.6
- red hat ansible automation platform ansible core 2
- red hat openshift ai (rhoai)
- red hat openshift ai 2.25
- red hat openshift virtualization 4
Affected packages
| Package | Affected | Fixed |
|---|---|---|
blackPyPI |
24.3.0 up to 26.3.1 | 26.3.1 |
blackDebian:12 |
All versions, plus listed versions 23.1.0-123.10.0-123.10.1-123.11.0-123.3.0-1 Show 26 moreShow less23.3.0-1~exp123.7.0-123.9.1-124.1.1-124.10.0-124.10.0-224.10.0-324.2.0-124.4.0-124.4.0-224.4.2-124.4.2-224.4.2-2~0exp024.8.0-125.1.0-0exp25.1.0-125.1.0-225.1.0-325.11.0-125.12.0-125.12.0-225.9.0-126.1.0-126.3.1-126.5.1-126.5.1-2 |
None known |
blackDebian:13 |
before 25.1.0-3+deb13u1, plus listed versions 25.1.0-3 |
25.1.0-3+deb13u1 |
blackDebian:14 |
before 26.3.1-1, plus listed versions 25.1.0-325.11.0-125.12.0-125.12.0-225.9.0-126.1.0-1 |
26.3.1-1 |
blackPyPI |
24.3.0 up to 26.3.1, plus listed versions 24.10.024.4.024.4.124.4.224.8.0 Show 7 moreShow less25.1.025.11.025.12.025.9.026.1.026.1a126.3.0 |
26.3.1 |
python-blackopenEuler:24.03-LTS-SP3 |
before 24.2.0-3.oe2403sp3 | 24.2.0-3.oe2403sp3 |
blackPyPI |
before 26.3.1, plus listed versions 18.3a018.3a118.3a218.3a318.3a4 Show 45 moreShow less18.4a018.4a118.4a218.4a318.4a418.5b018.5b118.6b018.6b118.6b218.6b318.6b418.9b019.10b019.3b020.8b020.8b121.10b021.11b021.11b121.12b021.4b021.4b121.4b221.5b021.5b121.5b221.6b021.7b021.8b021.9b022.1.022.10.022.12.022.3.022.6.022.8.023.1.023.10.023.10.123.11.023.12.023.12.123.1a123.3.0 |
26.3.1 |
blackRoot:PyPI |
before 24.3.0+aikido.2 | 24.3.0+aikido.226.1.0+aikido.224.10.0+aikido.225.11.0+aikido.224.4.2+aikido.225.9.0+aikido.323.1a1+aikido.123.9.0+aikido.123.1.0+aikido.123.10.1+aikido.123.12.0+aikido.123.7.0+aikido.123.12.1+aikido.123.9.1+aikido.123.3.0+aikido.123.10.0+aikido.123.11.0+aikido.125.12.0+aikido.123.12.1+aikido.223.10.0+aikido.223.3.0+aikido.223.1a1+aikido.223.9.1+aikido.223.12.0+aikido.223.1.0+aikido.223.11.0+aikido.223.7.0+aikido.223.10.1+aikido.223.9.0+aikido.225.12.0+aikido.2 |
python-blackopenSUSE:Leap 15.6 |
before 24.3.0-150400.9.11.1 | 24.3.0-150400.9.11.1 |
python-blackSUSE:Linux Enterprise Server 16.0 From an advisory covering 2 CVEs |
before 25.1.0-160000.3.1 | 25.1.0-160000.3.1 |
Show 10 moreShow less
| Package | Affected | Fixed |
|---|---|---|
python-blackSUSE:Linux Enterprise Server for SAP applications 16.0 From an advisory covering 2 CVEs |
before 25.1.0-160000.3.1 | 25.1.0-160000.3.1 |
blackUbuntu:20.04:LTS |
All versions, plus listed versions 19.3b0-1 |
None known |
blackUbuntu:22.04:LTS |
All versions, plus listed versions 20.8b1-421.4b2-321.10b0-121.12b0-1 |
None known |
blackUbuntu:24.04:LTS |
All versions, plus listed versions 23.7.0-123.10.1-123.11.0-124.2.0-1ubuntu1 |
None known |
blackUbuntu:25.10 |
All versions, plus listed versions 25.1.0-225.1.0-3 |
None known |
blackUbuntu:26.10 |
All versions, plus listed versions 26.3.1-126.5.1-1 |
None known |
blackUbuntu:26.04:LTS |
All versions, plus listed versions 25.1.0-325.9.0-125.11.0-125.12.0-126.1.0-126.1.0-1build126.3.1-1 |
None known |
python-blackopenSUSE:Tumbleweed From an advisory covering 2 CVEs |
before 26.3.1-1.1 | 26.3.1-1.1 |
ansible-lintopenSUSE:Tumbleweed |
before 26.9.0-1.1 | 26.9.0-1.1 |
python-blackopenSUSE:Leap 16.0 From an advisory covering 2 CVEs |
before 25.1.0-160000.3.1 | 25.1.0-160000.3.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-32274 is a high vulnerability (CVSS 8.7) in Psf Black, published March 12, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.69%, the 53rd percentile. Fixed in black 26.3.1.
References
github.com/psf/black/security/advisories/GHSA-3936-cmfr-pm3m
access.redhat.com/errata/RHSA-2026:10184
Show 21 moreShow less
bugzilla.redhat.com/show_bug.cgi?id=2447111
security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-32274.json
nvd.nist.gov/vuln/detail/CVE-2026-32274
security-tracker.debian.org/tracker/CVE-2026-32274
openeuler.org/zh/security/security-bulletins/detail?id=openEuler-SA-2026-4064
suse.com/support/update/announcement/2026/suse-su-20260900-1
bugzilla.suse.com/1259608
ubuntu.com/security/CVE-2026-32274
cve.org/CVERecord?id=CVE-2026-32274
Left out here: 20 versions. The JSON record has them.