PT-2026-24654 · Psf · Black

Parzivalhack · Publicado 2026-03-07 · Atualizado 2026-03-29 · CVE-2026-31900

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Black versions prior to 26.3.0

Description Black is a Python code formatter that provides a GitHub action for code formatting. The action supports an option, use pyproject: true, to read the Black version from the repository's pyproject.toml file. A malicious pull request could modify pyproject.toml to reference a malicious repository directly. This could result in arbitrary code execution within the GitHub Action's context, potentially allowing attackers to access secrets or permissions available to the action.

Recommendations Versions prior to 26.3.0 should be updated to version 26.3.0 or later. Do not use the use pyproject: true option in the psf/black GitHub Action.

Exploit

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2026-31900

GHSA-V53H-F6M7-XCGM

OPENSUSE-SU-2026:10372-1

OPENSUSE-SU-2026:20417-1

SUSE-SU-2026:20928-1

Produtos afetados

Black

Referências · 24

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/31xxx/CVE-2026-31900.json · Exploit
• https://github.com/psf/black/security/advisories/GHSA-v53h-f6m7-xcgm · Aviso do Fabricante
• https://github.com/psf/black/commit/0a2560b981364dde4c8cf8ce9d164c40669a8611 · Correção
• https://github.com/psf/black · Nota
• https://bugzilla.suse.com/1259608 · Nota
• https://suse.com/security/cve/CVE-2026-31900 · Nota
• https://twitter.com/TheRabbitPy/status/2035657360992080091 · Publicação no Twitter
• https://suse.com/support/update/announcement/2026/suse-su-202620928-1 · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-31900 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2026-31900 · Aviso do Fabricante
• https://osv.dev/vulnerability/openSUSE-SU-2026:20417-1 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-31900 · Nota de Segurança
• https://ubuntu.com/security/CVE-2026-31900 · Aviso do Fabricante
• https://osv.dev/vulnerability/openSUSE-SU-2026:10372-1 · Aviso do Fabricante
• https://twitter.com/infoflowcloud/status/2031869708371194006 · Publicação no Twitter