{"id":"ghsa-ghsa-cg8m-r9f2-5wm2","seq":309581,"kind":"advisory","title":"Black: GitHub Action installs unvalidated required-version from pyproject.toml","url":"https://github.com/advisories/GHSA-cg8m-r9f2-5wm2","permalink":"https://vulnpulse.app/items/ghsa-ghsa-cg8m-r9f2-5wm2","summary":"影響: pip:black < 26.10.1 → 26.10.1\nThe GitHub Action bundled with Black can read the version from tool.black.required-version if use_pyproject is set to True. This version is not validated and therefore can be used to execute untrusted code in the context of a victim's repository. Details This is similar to the previous CVE-2026-31900. The value in tool.black.required-version is accepted as the version to be installed by the action without validation. Proof of concept Reproduction requires a victim to use Black's GitHub Action w…","severity":"high","techs":["python","github"],"cves":["CVE-2026-114134"],"tags":["GHSA-cg8m-r9f2-5wm2","black"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-22T16:18:57.000Z","fetched_at":"2026-10-22T20:09:55.169Z"}