{"schema":"threatline.record/2","record":{"id":"CVE-2026-114134","aliases":["GHSA-cg8m-r9f2-5wm2"],"summary":"Black: GitHub Action installs unvalidated required-version from pyproject.toml","details":"### Summary\n\nThe GitHub Action bundled with Black can read the version from `tool.black.required-version` if `use_pyproject` is set to True. This version is not validated and therefore can be used to execute untrusted code in the context of a victim's repository.\n\n### Details\n\nThis is similar to the previous CVE-2026-31900. The value in `tool.black.required-version` is accepted as the version to be installed by the action without validation.\n\n### Proof of concept\n\nReproduction requires a victim to use Black's GitHub Action with `use_pyproject: true`. The attacker would then issue a PR to the victim's repository with `pyproject.toml` edited so that Black points to a malicious repository.\n\n### Impact\n\nThis is a remote code execution vulnerability impacting users using the GitHub Action bundled with psf/black and using the `use_pyproject: true` setting.","categories":["Libraries & packages"],"product":"black","vendor":"","ecosystem":"pip","affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-cg8m-r9f2-5wm2","source_modified_at":"2026-10-22T16:18:58Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"pip","name":"black"},"range":"< 26.10.1"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-cg8m-r9f2-5wm2","source_modified_at":"2026-10-22T16:30:30.132713769Z","fetched_at":"2026-10-23T18:52:38.922436Z","package":{"name":"black","ecosystem":"PyPI","purl":"pkg:pypi/black"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"26.10.1"}]}],"versions":["18.3a0","18.3a1","18.3a2","18.3a3","18.3a4","18.4a0","18.4a1","18.4a2","18.4a3","18.4a4","18.5b0","18.5b1","18.6b0","18.6b1","18.6b2","18.6b3","18.6b4","18.9b0","19.10b0","19.3b0","20.8b0","20.8b1","21.10b0","21.11b0","21.11b1","21.12b0","21.4b0","21.4b1","21.4b2","21.5b0","21.5b1","21.5b2","21.6b0","21.7b0","21.8b0","21.9b0","22.1.0","22.10.0","22.12.0","22.3.0","22.6.0","22.8.0","23.1.0","23.10.0","23.10.1","23.11.0","23.12.0","23.12.1","23.1a1","23.3.0"]}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-cg8m-r9f2-5wm2","source_modified_at":"2026-10-22T16:18:58Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"pip","name":"black"},"version":"26.10.1"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-cg8m-r9f2-5wm2","source_modified_at":"2026-10-22T16:30:30.132713769Z","fetched_at":"2026-10-23T18:52:38.922436Z","package":{"name":"black","ecosystem":"PyPI","purl":"pkg:pypi/black"},"version":"26.10.1"}],"cvss":8.7,"severity":"High","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-22T16:18:57Z","modified_at":"2026-10-22T16:30:30.132713769Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/advisories/GHSA-cg8m-r9f2-5wm2","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-22T16:18:58Z"},{"source":"OSV","url":"https://osv.dev/vulnerability/GHSA-cg8m-r9f2-5wm2","fetched_at":"2026-10-23T18:52:38.922436Z","source_modified_at":"2026-10-22T16:30:30.132713769Z"}],"sources":["GitHub Advisory Database","OSV"],"references":[{"url":"https://github.com/psf/black/security/advisories/GHSA-cg8m-r9f2-5wm2","source":"GitHub Advisory Database"},{"url":"https://github.com/psf/black/pull/5510","source":"GitHub Advisory Database"},{"url":"https://github.com/psf/black/commit/ac1f71563aeccf73cf13ece00f231d9d6c66a514","source":"GitHub Advisory Database"},{"url":"https://github.com/psf/black/releases/tag/26.10.1","source":"GitHub Advisory Database"},{"url":"https://github.com/advisories/GHSA-cg8m-r9f2-5wm2","source":"GitHub Advisory Database"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"ecosystem","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-22T16:30:30.132713769Z","content_hash":"84e95dd7eb5df8c373ccba06a7b902d5e16cd00cd29cd2f54f963c93bc980919"}}