CVE-2026-114134
Black: GitHub Action installs unvalidated required-version from pyproject.toml
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
Black is the uncompromising Python code formatter. Prior to 26.10.1, the Black GitHub Action with use_pyproject: true accepts tool.black.required-version from pyproject.toml without validating that it is a released Black version specifier. An attacker who can submit a pull request can change that field to a direct reference to attacker-controlled code, causing the workflow to install and execute the code in the victim repository's GitHub Actions context. This issue is fixed in version 26.10.1.
| CWE | CWE-829 |
| Vendor | psf |
| Product | black |
| Published | Nov 5, 2026 |
Stay Ahead of the Next One
Get instant alerts for psf black
Be the first to know when new unknown vulnerabilities affecting psf black are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
psf / black
< 26.10.1