PT-2026-24654 · Psf · Black

Parzivalhack · Published 2026-03-07 · Updated 2026-03-29 · CVE-2026-31900

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Black versions prior to 26.3.0

Description Black is a Python code formatter that provides a GitHub action for code formatting. The action supports an option, use pyproject: true, to read the Black version from the repository's pyproject.toml file. A malicious pull request could modify pyproject.toml to reference a malicious repository directly. This could result in arbitrary code execution within the GitHub Action's context, potentially allowing attackers to access secrets or permissions available to the action.

Recommendations Versions prior to 26.3.0 should be updated to version 26.3.0 or later. Do not use the use pyproject: true option in the psf/black GitHub Action.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2026-31900

GHSA-V53H-F6M7-XCGM

OPENSUSE-SU-2026:10372-1

OPENSUSE-SU-2026:20417-1

SUSE-SU-2026:20928-1

Affected Products

Black

References · 24

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/31xxx/CVE-2026-31900.json · Exploit
• https://github.com/psf/black/security/advisories/GHSA-v53h-f6m7-xcgm · Vendor Advisory
• https://github.com/psf/black/commit/0a2560b981364dde4c8cf8ce9d164c40669a8611 · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-31900 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-31900 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:20417-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-31900 · Security Note
• https://ubuntu.com/security/CVE-2026-31900 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10372-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-v53h-f6m7-xcgm · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-31900 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-31900 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-31900 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:20928-1 · Vendor Advisory
• https://github.com/psf/black · Note