Black: GitHub Action installs unvalidated required-version from pyproject.toml

影響: pip:black < 26.10.1 → 26.10.1

The GitHub Action bundled with Black can read the version from tool.black.required-version if use_pyproject is set to True. This version is not validated and therefore can be used to execute untrusted code in the context of a victim's repository. Details This is similar to the previous CVE-2026-31900. The value in tool.black.required-version is accepted as the version to be installed by the action without validation. Proof of concept Reproduction requires a victim to use Black's GitHub Action w…

Read on GitHub Advisory Database

On 10/23/2026, 01:18 AM, GitHub Advisory Database published "Black: GitHub Action installs unvalidated required-version from pyproject.toml" (type: Advisory). Severity is "High" (high). Related technologies: Python, GitHub. CVE: CVE-2026-114134.