CVE-2026-31900
Critical · 9.8CVSS
9.8
EPSS
0.7%
Published
Mar 11, 2026
CISA due date
—
The record
Black is the uncompromising Python code formatter. Black provides a GitHub action for formatting code. This action supports an option, use_pyproject: true, for reading the version of Black to use from the repository pyproject.toml. A malicious pull request could edit pyproject.toml to use a direct URL reference to a malicious repository. This could lead to arbitrary code execution in the context of the GitHub Action. Attackers could then gain access to secrets or permissions available in the context of the action. Version 26.3.0 fixes this vulnerability.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| openSUSE:Leap 16.0 | python-black | 0 | 25.1.0-160000.3.1 |
| openSUSE:Tumbleweed | python-black | 0 | 26.3.1-1.1 |
Related vulnerabilities
- CVE-2026-32274 Black is the uncompromising Python code formatter. Also affects python-black
- CVE-2026-113786 pypdf is a free and open-source pure-python PDF library. CWE-20
- CVE-2026-112081 A vulnerability was determined in hankcs HanLP up to 2.1.0-beta.64. CWE-20
- CVE-2026-111869 A vulnerability was identified in makeplane plane up to 1.4.2. CWE-20
- CVE-2026-100347 kin-openapi is a Go project for handling OpenAPI files. CWE-20
- CVE-2026-99999 In the Linux kernel, the following vulnerability has been resolved: ipv4: validate… CWE-20
- CVE-2026-107726 Hazelcast is a unified real-time data platform combining stream processing with a fast… CWE-20
- CVE-2026-105757 vLLM is an inference and serving engine for large language models. CWE-20