CVE-2024-21503Medium· 5.3▾ SunlitBlack vulnerable to Regular Expression Denial of Service (ReDoS)
▾ Sunlit zone — Low / medium · no exploitation signal
impact 29.2 · likelihood 0.2 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 12.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
1.0%
Versions of the package black before 24.3.0 are vulnerable to Regular Expression Denial of Service (ReDoS) via the lines_with_leading_tabs_expanded function in the strings.py file. An attacker could exploit this vulnerability by crafting a malicious input that causes a denial of service.
Exploiting this vulnerability is possible when running Black on untrusted input, or if you habitually put thousands of leading tab characters in your docstrings.
black < 24.3.0Upgrade to a patched release:
black 24.3.0Connected by shared product, vendor, weakness, or advisory.
CVE-2026-32274High· 7.5Black: Arbitrary file writes from unsanitized user input in cache file name
CVE-2026-31900Critical· 9.8Black is the uncompromising Python code formatter. Black provides a GitHub action for formatting code. This action supports an option, us…