CVE-2026-114134
Black: GitHub Action installs unvalidated required-version from pyproject.toml
Impact
### Summary The GitHub Action bundled with Black can read the version from `tool.black.required-version` if `use_pyproject` is set to True. This version is not validated and therefore can be used to execute untrusted code in the context of a victim's repository. ### Details This is similar to the previous CVE-2026-31900. The value in `tool.black.required-version` is accepted as the version to be installed by the action without validation. ### Proof of concept Reproduction requires a victim to use Black's GitHub Action with `use_pyproject: true`. The attacker would then issue a PR to the victim's repository with `pyproject.toml` edited so that Black points to a malicious repository. ### Impact This is a remote code execution vulnerability impacting users using the GitHub Action bundled with psf/black and using the `use_pyproject: true` setting.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| pip | black | < 26.10.1 | 26.10.1 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/advisories/GHSA-cg8m-r9f2-5wm2
- https://github.com/psf/black/security/advisories/GHSA-cg8m-r9f2-5wm2
- https://github.com/psf/black/pull/5510
- https://github.com/psf/black/commit/ac1f71563aeccf73cf13ece00f231d9d6c66a514
- https://github.com/psf/black/releases/tag/26.10.1