{"id":"CVE-2026-32274","aliases":["GHSA-3936-cmfr-pm3m","PYSEC-2026-2121"],"title":"Black: Arbitrary file writes from unsanitized user input in cache file name","summary":"Black: Arbitrary file writes from unsanitized user input in cache file name","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","vendor":"black","product":"black","ecosystem":"pip","affected":["black >= 24.3.0, < 26.3.1"],"patched":["black 26.3.1"],"published":"2026-03-12","updated":"2026-09-10","sourceUpdated":"2026-09-10T03:50:36.703011526Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-3936-cmfr-pm3m","references":[{"url":"https://github.com/psf/black/security/advisories/GHSA-3936-cmfr-pm3m"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32274"},{"url":"https://github.com/psf/black/pull/4176"},{"url":"https://github.com/psf/black/pull/5038"},{"url":"https://github.com/psf/black/commit/4937fe6cf241139ddbfc16b0bdbb5b422798909d"},{"url":"https://github.com/psf/black/commit/ed770ba4dd50c419148a0fca2b43937a7447e1f9"},{"url":"https://access.redhat.com/errata/RHSA-2026:10184"},{"url":"https://access.redhat.com/errata/RHSA-2026:13545"},{"url":"https://access.redhat.com/errata/RHSA-2026:13553"},{"url":"https://access.redhat.com/security/cve/CVE-2026-32274"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2447111"},{"url":"https://github.com/psf/black"},{"url":"https://github.com/psf/black/releases/tag/26.3.1"},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/black/PYSEC-2026-2121.yaml"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-32274.json"}],"tags":["osv","pip"],"epss":0.00621,"epssPercentile":0.48396,"ingestedAt":"2026-07-13T18:57:51.775Z","slug":"CVE-2026-32274","body":"## Overview\n\n### Impact\n\nBlack writes a cache file, the name of which is computed from various formatting options. The value of the `--python-cell-magics` option was placed in the filename without sanitization, which allowed an attacker who controls the value of this argument to write cache files to arbitrary file system locations. \n\n### Patches\n\nFixed in Black 26.3.1.\n\n### Workarounds\n\nDo not allow untrusted user input into the value of the `--python-cell-magics` option.\n\n## Affected packages\n\n- `black >= 24.3.0, < 26.3.1`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `black 26.3.1`","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":201600,"id":"CVE-2026-32274","ts":1789399517355,"field":"cvss","old":null,"new":"7.5"},{"seq":200332,"id":"CVE-2026-32274","ts":1789397102355,"field":"cvss","old":"7.5","new":null},{"seq":198256,"id":"CVE-2026-32274","ts":1789391751393,"field":"cvss","old":null,"new":"7.5"},{"seq":196049,"id":"CVE-2026-32274","ts":1789383401863,"field":"cvss","old":"7.5","new":null},{"seq":194978,"id":"CVE-2026-32274","ts":1789380314520,"field":"cvss","old":null,"new":"7.5"},{"seq":193765,"id":"CVE-2026-32274","ts":1789378271314,"field":"cvss","old":"7.5","new":null},{"seq":192552,"id":"CVE-2026-32274","ts":1789376235375,"field":"cvss","old":null,"new":"7.5"},{"seq":191339,"id":"CVE-2026-32274","ts":1789373133148,"field":"cvss","old":"7.5","new":null},{"seq":190124,"id":"CVE-2026-32274","ts":1789369123144,"field":"cvss","old":null,"new":"7.5"},{"seq":188911,"id":"CVE-2026-32274","ts":1789368040830,"field":"cvss","old":"7.5","new":null},{"seq":187694,"id":"CVE-2026-32274","ts":1789364998483,"field":"cvss","old":null,"new":"7.5"},{"seq":186481,"id":"CVE-2026-32274","ts":1789363008952,"field":"cvss","old":"7.5","new":null},{"seq":185267,"id":"CVE-2026-32274","ts":1789360971715,"field":"cvss","old":null,"new":"7.5"},{"seq":184054,"id":"CVE-2026-32274","ts":1789357945854,"field":"cvss","old":"7.5","new":null},{"seq":182306,"id":"CVE-2026-32274","ts":1789354099873,"field":"cvss","old":null,"new":"7.5"},{"seq":181099,"id":"CVE-2026-32274","ts":1789352949708,"field":"cvss","old":"7.5","new":null},{"seq":179892,"id":"CVE-2026-32274","ts":1789350003456,"field":"cvss","old":null,"new":"7.5"},{"seq":178685,"id":"CVE-2026-32274","ts":1789347820595,"field":"cvss","old":"7.5","new":null},{"seq":177478,"id":"CVE-2026-32274","ts":1789346183648,"field":"cvss","old":null,"new":"7.5"},{"seq":176271,"id":"CVE-2026-32274","ts":1789342754230,"field":"cvss","old":"7.5","new":null},{"seq":176055,"id":"CVE-2026-32274","ts":1789342360813,"field":"cvss","old":null,"new":"7.5"},{"seq":175595,"id":"CVE-2026-32274","ts":1789338392301,"field":"cvss","old":"7.5","new":null},{"seq":174390,"id":"CVE-2026-32274","ts":1789334606757,"field":"cvss","old":null,"new":"7.5"},{"seq":173185,"id":"CVE-2026-32274","ts":1789333221954,"field":"cvss","old":"7.5","new":null},{"seq":171999,"id":"CVE-2026-32274","ts":1789330888504,"field":"cvss","old":null,"new":"7.5"},{"seq":170813,"id":"CVE-2026-32274","ts":1789328401385,"field":"cvss","old":"7.5","new":null},{"seq":169608,"id":"CVE-2026-32274","ts":1789326912936,"field":"cvss","old":null,"new":"7.5"},{"seq":168403,"id":"CVE-2026-32274","ts":1789323447724,"field":"cvss","old":"7.5","new":null},{"seq":167198,"id":"CVE-2026-32274","ts":1789319378084,"field":"cvss","old":null,"new":"7.5"},{"seq":165993,"id":"CVE-2026-32274","ts":1789318293557,"field":"cvss","old":"7.5","new":null},{"seq":164788,"id":"CVE-2026-32274","ts":1789315547287,"field":"cvss","old":null,"new":"7.5"},{"seq":163583,"id":"CVE-2026-32274","ts":1789313265508,"field":"cvss","old":"7.5","new":null},{"seq":162378,"id":"CVE-2026-32274","ts":1789311716419,"field":"cvss","old":null,"new":"7.5"},{"seq":161173,"id":"CVE-2026-32274","ts":1789308270942,"field":"cvss","old":"7.5","new":null},{"seq":160678,"id":"CVE-2026-32274","ts":1789304198114,"field":"cvss","old":null,"new":"7.5"},{"seq":158516,"id":"CVE-2026-32274","ts":1789299288431,"field":"cvss","old":"7.5","new":null},{"seq":157480,"id":"CVE-2026-32274","ts":1789296470717,"field":"cvss","old":null,"new":"7.5"},{"seq":156275,"id":"CVE-2026-32274","ts":1789294391141,"field":"cvss","old":"7.5","new":null},{"seq":155070,"id":"CVE-2026-32274","ts":1789292646920,"field":"cvss","old":null,"new":"7.5"},{"seq":153865,"id":"CVE-2026-32274","ts":1789289353953,"field":"cvss","old":"7.5","new":null},{"seq":153077,"id":"CVE-2026-32274","ts":1789285265935,"field":"cvss","old":null,"new":"7.5"},{"seq":148011,"id":"CVE-2026-32274","ts":1789270883684,"field":"cvss","old":"7.5","new":null},{"seq":146051,"id":"CVE-2026-32274","ts":1789269180813,"field":"cvss","old":null,"new":"7.5"},{"seq":144954,"id":"CVE-2026-32274","ts":1789266111702,"field":"cvss","old":"7.5","new":null},{"seq":143858,"id":"CVE-2026-32274","ts":1789262451924,"field":"cvss","old":null,"new":"7.5"},{"seq":142694,"id":"CVE-2026-32274","ts":1789261196582,"field":"cvss","old":"7.5","new":null},{"seq":141530,"id":"CVE-2026-32274","ts":1789258621677,"field":"cvss","old":null,"new":"7.5"},{"seq":140332,"id":"CVE-2026-32274","ts":1789256411327,"field":"cvss","old":"7.5","new":null},{"seq":139134,"id":"CVE-2026-32274","ts":1789254594438,"field":"cvss","old":null,"new":"7.5"},{"seq":137936,"id":"CVE-2026-32274","ts":1789251595509,"field":"cvss","old":"7.5","new":null}]}