https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 11 Nov 2026 07:07:06 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-114134 <p>Black is the uncompromising Python code formatter. Prior to 26.10.1, the Black GitHub Action with use_pyproject: true accepts tool.black.required-version from pyproject.toml without validating that it is a released Black version specifier. An attacker who can submit a pull request can change that field to a direct reference to attacker-controlled code, causing the workflow to install and execute the code in the victim repository&#39;s GitHub Actions context. This issue is fixed in version 26.10.1.</p> <p>Black is the uncompromising Python code formatter. Prior to 26.10.1, the Black GitHub Action with use_pyproject: true accepts tool.black.required-version from pyproject.toml without validating that it is a released Black version specifier. An attacker who can submit a pull request can change that field to a direct reference to attacker-controlled code, causing the workflow to install and execute the code in the victim repository&#39;s GitHub Actions context. This issue is fixed in version 26.10.1.</p> https://db.gcve.eu/vuln/fkie_cve-2026-114134 https://db.gcve.eu/vuln/ghsa-cg8m-r9f2-5wm2 <p><strong>Affected:</strong> PyPI: black</p> <p>### Summary</p> <p>The GitHub Action bundled with Black can read the version from `tool.black.required-version` if `use_pyproject` is set to True. This version is not validated and therefore can be used to execute untrusted code in the context of a victim&#39;s repository.</p> <p>### Details</p> <p>This is similar to the previous CVE-2026-31900. The value in `tool.black.required-version` is accepted as the version to be installed by the action without validation.</p> <p>### Proof of concept</p> <p>Reproduction requires a victim to use Black&#39;s GitHub Action with `use_pyproject: true`. The attacker would then issue a PR to the victim&#39;s repository with `pyproject.toml` edited so that Black points to a malicious repository.</p> <p>### Impact</p> <p>This is a remote code execution vulnerability impacting users using the GitHub Action bundled with psf/black and using the `use_pyproject: true` setting.</p> <p><strong>Affected:</strong> PyPI: black</p> <p>### Summary</p> <p>The GitHub Action bundled with Black can read the version from `tool.black.required-version` if `use_pyproject` is set to True. This version is not validated and therefore can be used to execute untrusted code in the context of a victim&#39;s repository.</p> <p>### Details</p> <p>This is similar to the previous CVE-2026-31900. The value in `tool.black.required-version` is accepted as the version to be installed by the action without validation.</p> <p>### Proof of concept</p> <p>Reproduction requires a victim to use Black&#39;s GitHub Action with `use_pyproject: true`. The attacker would then issue a PR to the victim&#39;s repository with `pyproject.toml` edited so that Black points to a malicious repository.</p> <p>### Impact</p> <p>This is a remote code execution vulnerability impacting users using the GitHub Action bundled with psf/black and using the `use_pyproject: true` setting.</p> https://db.gcve.eu/vuln/ghsa-cg8m-r9f2-5wm2