Black: GitHub Action installs unvalidated required-version from pyproject.toml

影響: pip:black < 26.10.1 → 26.10.1

The GitHub Action bundled with Black can read the version from tool.black.required-version if use_pyproject is set to True. This version is not validated and therefore can be used to execute untrusted code in the context of a victim's repository. Details This is similar to the previous CVE-2026-31900. The value in tool.black.required-version is accepted as the version to be installed by the action without validation. Proof of concept Reproduction requires a victim to use Black's GitHub Action w…

GitHub Advisory Databaseで読む

2026/10/23 01:18、GitHub Advisory Databaseが「Black: GitHub Action installs unvalidated required-version from pyproject.toml」を公開しました (種別: 脆弱性アドバイザリ)。重大度は「重要」(high) です。関連する技術: Python、GitHub。CVE: CVE-2026-114134。