High severity7.5NVD Advisory· Published Mar 12, 2026· Updated Aug 3, 2026
CVE-2026-32274
CVE-2026-32274
Description
Black is the uncompromising Python code formatter. Starting in version 24.3.0 and prior to version 26.3.1, Black writes a cache file, the name of which is computed from various formatting options. The value of the --python-cell-magics option was placed in the filename without sanitization, which allowed an attacker who controls the value of this argument to write cache files to arbitrary file system locations. Fixed in Black 26.3.1.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
blackPyPI | >= 24.3.0, < 26.3.1 | 26.3.1 |
Affected products
14- osv-coords12 versionspkg:apk/chainguard/kserve-storage-controllerpkg:apk/chainguard/label-studiopkg:apk/chainguard/nemopkg:apk/chainguard/open-webuipkg:apk/wolfi/kserve-storage-controllerpkg:apk/wolfi/open-webuipkg:pypi/blackpkg:rpm/opensuse/python-black&distro=openSUSE%20Leap%2015.6pkg:rpm/opensuse/python-black&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/python-black&distro=openSUSE%20Tumbleweedpkg:rpm/suse/python-black&distro=SUSE%20Linux%20Enterprise%20Server%2016.0pkg:rpm/suse/python-black&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20applications%2016.0
< 0.16.0-r22+ 11 more
- (no CPE)range: < 0.16.0-r22
- (no CPE)range: < 1.23.0-r0
- (no CPE)range: < 2.7.0-r2
- (no CPE)range: < 0.8.10-r1
- (no CPE)range: < 0.16.0-r22
- (no CPE)range: < 0.8.10-r1
- (no CPE)range: < 26.3.1
- (no CPE)range: < 24.3.0-150400.9.11.1
- (no CPE)range: < 25.1.0-160000.3.1
- (no CPE)range: < 26.3.1-1.1
- (no CPE)range: < 25.1.0-160000.3.1
- (no CPE)range: < 25.1.0-160000.3.1
Patches
Vulnerability mechanics
References
15- github.com/psf/black/commit/4937fe6cf241139ddbfc16b0bdbb5b422798909dnvdPatchWEB
- github.com/psf/black/pull/5038nvdIssue TrackingPatchWEB
- github.com/advisories/GHSA-3936-cmfr-pm3mghsaADVISORY
- github.com/psf/black/security/advisories/GHSA-3936-cmfr-pm3mnvdVendor AdvisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2026-32274ghsaADVISORY
- access.redhat.com/errata/RHSA-2026:10184nvdWEB
- access.redhat.com/errata/RHSA-2026:13545nvdWEB
- access.redhat.com/errata/RHSA-2026:13553nvdWEB
- access.redhat.com/security/cve/CVE-2026-32274nvdWEB
- bugzilla.redhat.com/show_bug.cginvdWEB
- github.com/psf/black/commit/ed770ba4dd50c419148a0fca2b43937a7447e1f9nvdWEB
- github.com/psf/black/pull/4176nvdWEB
- github.com/psf/black/releases/tag/26.3.1nvdRelease NotesWEB
- github.com/pypa/advisory-database/tree/main/vulns/black/PYSEC-2026-2121.yamlnvdWEB
- security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-32274.jsonnvdWEB
News mentions
0No linked articles in our index yet.