## Black: GitHub Action installs unvalidated required-version from pyproject.toml

- 種別: advisory
- 重大度: high
- 関連技術: python, github
- CVE: CVE-2026-114134
- 公開日時: 2026-10-22T16:18:57.000Z
- 情報源: GitHub Advisory Database (https://github.com/advisories/GHSA-cg8m-r9f2-5wm2)
- パーマリンク: https://vulnpulse.app/items/ghsa-ghsa-cg8m-r9f2-5wm2

影響: pip:black < 26.10.1 → 26.10.1
The GitHub Action bundled with Black can read the version from tool.black.required-version if use_pyproject is set to True. This version is not validated and therefore can be used to execute untrusted code in the context of a victim's repository. Details This is similar to the previous CVE-2026-31900. The value in tool.black.required-version is accepted as the version to be installed by the action without validation. Proof of concept Reproduction requires a victim to use Black's GitHub Action w…