{"id":"CVE-2026-114134","aliases":["GHSA-cg8m-r9f2-5wm2"],"title":"Black: GitHub Action installs unvalidated required-version from pyproject.toml","summary":"Black: GitHub Action installs unvalidated required-version from pyproject.toml","severity":"high","cwe":["CWE-829"],"vendor":"black","product":"black","ecosystem":"pip","affected":["black < 26.10.1"],"patched":["black 26.10.1"],"published":"2026-10-22","updated":"2026-10-22","sourceUpdated":"2026-10-22T16:18:58Z","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-cg8m-r9f2-5wm2","references":[{"url":"https://github.com/psf/black/security/advisories/GHSA-cg8m-r9f2-5wm2"},{"url":"https://github.com/psf/black/pull/5510"},{"url":"https://github.com/psf/black/commit/ac1f71563aeccf73cf13ece00f231d9d6c66a514"},{"url":"https://github.com/psf/black/releases/tag/26.10.1"},{"url":"https://github.com/advisories/GHSA-cg8m-r9f2-5wm2"}],"tags":["ghsa","pip"],"ingestedAt":"2026-10-22T22:00:50.257Z","slug":"CVE-2026-114134","body":"## Overview\n\n### Summary\n\nThe GitHub Action bundled with Black can read the version from `tool.black.required-version` if `use_pyproject` is set to True. This version is not validated and therefore can be used to execute untrusted code in the context of a victim's repository.\n\n### Details\n\nThis is similar to the previous CVE-2026-31900. The value in `tool.black.required-version` is accepted as the version to be installed by the action without validation.\n\n### Proof of concept\n\nReproduction requires a victim to use Black's GitHub Action with `use_pyproject: true`. The attacker would then issue a PR to the victim's repository with `pyproject.toml` edited so that Black points to a malicious repository.\n\n### Impact\n\nThis is a remote code execution vulnerability impacting users using the GitHub Action bundled with psf/black and using the `use_pyproject: true` setting.\n\n## Affected packages\n\n- `black < 26.10.1`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `black 26.10.1`","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}