CVE-2026-32274

What it actually does

CVE-2026-32274 is a path traversal flaw in the Python Black formatter before version 26.3.1. Black computes a cache filename from formatting options, and the value supplied through the --python-cell-magics option was inserted into that filename without adequate sanitization. If an attacker can control that option in a Black invocation or configuration file, they can cause Black to write its cache file outside the intended cache directory to an attacker-chosen filesystem path. The impact is primarily arbitrary file write with the privileges of the user or automation account running Black; this can be more serious in CI/CD, developer workstations, build agents, or automation environments where overwriting files may alter later execution, poison build outputs, disrupt tooling, or place files in sensitive locations.

Why it matters to the business

Organizations using Black in developer workflows, automated formatting jobs, pre-commit hooks, or CI/CD pipelines may be exposed if untrusted projects, pull requests, repositories, or configuration values can influence Black command-line arguments or configuration. Successful exploitation could allow an attacker to write unexpected files on developer machines or build infrastructure, potentially causing build disruption, tampering with automation behavior, or enabling follow-on compromise if the written file is later trusted or executed by other tooling. The issue is not currently listed in the CISA KEV catalog, has no reported ransomware association, and has a low EPSS score, so broad active exploitation is not indicated; however, the risk is meaningful in environments that run formatting tools against untrusted code or contributor-controlled configuration.

How an attack unfolds

An attacker first needs a path to influence how Black is invoked, most commonly by contributing or modifying project configuration, CI job parameters, pre-commit configuration, wrapper scripts, or build definitions that include the --python-cell-magics option. The attacker supplies a crafted value containing path traversal sequences or an absolute path component. Vulnerable Black versions use that unsanitized option value while constructing the cache filename. When Black runs, it writes a cache file to the computed path rather than remaining confined to the expected cache directory. The attacker then relies on the written file to cause impact: overwriting or creating a file in a sensitive location, disrupting a workflow, planting data where another process will consume it, or modifying files that affect subsequent build or developer automation. Exploitation is most plausible where Black is run automatically on attacker-supplied repositories or pull requests without isolating the workspace and cache directory.

How to fix it

Upgrade Black to version 26.3.1 or later everywhere it is installed, including developer workstations, CI/CD images, build containers, pre-commit environments, virtual environments, and pinned dependency files. If immediate upgrade is not possible, do not allow untrusted users or untrusted repositories to control the --python-cell-magics option or Black configuration, and run Black in isolated containers or sandboxes with a restricted workspace and non-privileged user. Set cache directories to disposable, workspace-scoped locations where possible, prevent formatter jobs from writing outside the checkout directory, and avoid running Black with elevated privileges. Review package pins such as requirements.txt, pyproject.toml, poetry.lock, Pipfile.lock, uv.lock, conda environment files, and CI image definitions for Black versions earlier than 26.3.1.

How to confirm the fix worked

Confirm that all reachable installations report Black version 26.3.1 or later using commands such as `black --version`, package inventory, SBOM data, or dependency lockfile review. Validate CI/CD runners, pre-commit hook environments, and container images separately because they may use different Black installations than developer machines. Inspect project and automation configuration for use of --python-cell-magics or python-cell-magics values, especially values containing `../`, `..\`, leading `/`, Windows drive prefixes, or other path separators. Where feasible, run a controlled negative test in a disposable environment using a crafted --python-cell-magics value and confirm that the patched version rejects or safely handles it and does not create files outside the intended Black cache directory. Confirm that Black is not executed as root or as a highly privileged service account in automated pipelines.

Typical attack path

1. Identify a workflow, repository, build job, pre-commit hook, or automation path that runs Black before version 26.3.1.
2. Gain control over Black options through command-line arguments, pyproject.toml, CI configuration, wrapper scripts, or repository-controlled formatter settings.
3. Set --python-cell-magics to a crafted value containing path traversal sequences or an absolute filesystem path.
4. Trigger Black execution through a formatting job, pull request check, local developer workflow, or build pipeline.
5. Black constructs a cache filename using the unsanitized option value and writes the cache file outside the intended cache directory.
6. Use the unexpected file write to corrupt files, alter downstream automation behavior, poison build artifacts, or stage a follow-on attack depending on file permissions and execution context.

How to detect it

To determine whether exploitation already occurred, review repository history, pull requests, CI/CD job definitions, pre-commit configuration, and formatter wrapper scripts for suspicious additions or changes to --python-cell-magics or python-cell-magics values. Focus on values containing path traversal sequences, absolute paths, Windows drive paths, or path separators. Examine CI/CD logs and shell history for Black invocations with crafted --python-cell-magics arguments. Review filesystem metadata on build agents and developer systems for unexpected files created or modified at the same time Black ran, especially outside the normal Black cache directory. Relevant log sources include CI job logs, build runner command transcripts, auditd or EDR file-write telemetry, shell history, process creation logs, repository commit history, and package manager or pre-commit logs. Since the vulnerability writes Black cache content rather than a fixed malicious payload, detection should correlate suspicious Black options with unexpected file creation by a `black` or `python -m black` process outside expected cache locations.

• --python-cell-magics=../
• --python-cell-magics=..\\
• --python-cell-magics=/
• --python-cell-magics=~/
• --python-cell-magics=C:\\
• python-cell-magics = ["../
• python-cell-magics = ["..\\
• python_cell_magics = ["../
• python_cell_magics = ["..\\
• python -m black --python-cell-magics
• black --python-cell-magics
• /.cache/black/
• \\.cache\\black\\

What your security team should do

• Prioritize upgrading Black to 26.3.1 or later in CI/CD images, build agents, pre-commit environments, and developer bootstrap templates.
• Search source repositories and pipeline definitions for --python-cell-magics or python-cell-magics settings, and review any value containing traversal patterns or path separators.
• Treat formatter execution on untrusted pull requests or external contributions as untrusted code processing; run it in isolated containers with least privilege and disposable filesystems.
• Add dependency policy checks to block Black versions earlier than 26.3.1 in new builds and lockfile updates.
• Ensure build agents and developer automation do not run Black with elevated privileges and cannot write to sensitive host paths.
• Review recent CI jobs and repository changes for suspicious formatter option changes if Black was run on untrusted input before remediation.
• Because there is no KEV listing, no known ransomware association, low EPSS, and no public exploit maturity indicated, handle as a targeted workflow-hardening issue rather than an emergency internet-wide incident unless local exposure involves untrusted contributors or privileged automation.