Black: GitHub Action installs unvalidated required-version from pyproject.toml

影響: pip:black < 26.10.1 → 26.10.1

The GitHub Action bundled with Black can read the version from tool.black.required-version if use_pyproject is set to True. This version is not validated and therefore can be used to execute untrusted code in the context of a victim's repository. Details This is similar to the previous CVE-2026-31900. The value in tool.black.required-version is accepted as the version to be installed by the action without validation. Proof of concept Reproduction requires a victim to use Black's GitHub Action w…

在 GitHub Advisory Database 阅读

2026/10/23 01:18，GitHub Advisory Database 发布了“Black: GitHub Action installs unvalidated required-version from pyproject.toml”（类型：漏洞公告）。严重程度为“高危”（high）。相关技术：Python、GitHub。CVE：CVE-2026-114134。