CVE-2026-32274High· 7.5▾ TwilightBlack: Arbitrary file writes from unsanitized user input in cache file name
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 13.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
0.6%
0.6% → 0.6%
Last analysed / modified upstream
7.5 → —
— → 7.5
7.5 → —
— → 7.5
7.5 → —
— → 7.5
7.5 → —
— → 7.5
7.5 → —
— → 7.5
7.5 → —
— → 7.5
Black writes a cache file, the name of which is computed from various formatting options. The value of the --python-cell-magics option was placed in the filename without sanitization, which allowed an attacker who controls the value of this argument to write cache files to arbitrary file system locations.
Fixed in Black 26.3.1.
Do not allow untrusted user input into the value of the --python-cell-magics option.
black >= 24.3.0, < 26.3.1Upgrade to a patched release:
black 26.3.1Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2024-21503Medium· 5.3Black vulnerable to Regular Expression Denial of Service (ReDoS)
CVE-2026-31900Critical· 9.8Black is the uncompromising Python code formatter. Black provides a GitHub action for formatting code. This action supports an option, us…