~ / search / GHSA-3936-cmfr-pm3m

GHSA-3936-cmfr-pm3m

Black: Arbitrary file writes from unsanitized user input in cache file name

Source: GitHub Advisory Database (reviewed) High CVE-2026-32274

Packages

EcosystemPackageAffectedFixed in
PyPI black >= 24.3.0, < 26.3.1 26.3.1

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact Black writes a cache file, the name of which is computed from various formatting options. The value of the `--python-cell-magics` option was placed in the filename without sanitization, which allowed an attacker who controls the value of this argument to write cache files to arbitrary file system locations. ### Patches Fixed in Black 26.3.1. ### Workarounds Do not allow untrusted user input into the value of the `--python-cell-magics` option.

References

External links from the advisory. They lead to third-party sites.