Log in Start free

Vulnerability · Published Mar 11, 2026 · Assigned by GitHub_M

CVE-2026-31900Black's vulnerable version parsing leads to RCE in GitHub Action

High 8.7

In plain English

A high-severity improper input validation in black from psf. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 44% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)8.7High
Exploit odds (30 days)0.5%top 55.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling1Public PoC

Official description

Black is the uncompromising Python code formatter. Black provides a GitHub action for formatting code. This action supports an option, use_pyproject: true, for reading the version of Black to use from the repository pyproject.toml. A malicious pull request could edit pyproject.toml to use a direct URL reference to a malicious repository. This could lead to arbitrary code execution in the context of the GitHub Action. Attackers could then gain access to secrets or permissions available in the context of the action. Version 26.3.0 fixes this vulnerability.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12blackno fix listedDEBIAN-CVE-2026-31900
Debian:13blackno fix listedDEBIAN-CVE-2026-31900
Debian:14black26.3.1-1DEBIAN-CVE-2026-31900
PyPIblack26.3.0PYSEC-2026-2120
Ubuntu:22.04:LTSblackno fix listedUBUNTU-CVE-2026-31900
Ubuntu:24.04:LTSblackno fix listedUBUNTU-CVE-2026-31900
Ubuntu:25.10blackno fix listedUBUNTU-CVE-2026-31900
Ubuntu:26.04:LTSblackno fix listedUBUNTU-CVE-2026-31900
Ubuntu:26.10blackno fix listedUBUNTU-CVE-2026-31900

Affected products (as reported)

VendorProductVersions
psf black < 26.3.0

Weakness: CWE-20 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References