Code Formatting Vulnerability in Black Python Formatter by PSF

CVE-2026-31900

What is CVE-2026-31900?

The Black Python code formatter allows for the execution of GitHub Actions using a configuration file called pyproject.toml. A vulnerability arose when this action's configuration could be manipulated through a malicious pull request. By altering pyproject.toml to reference a malicious repository directly, an attacker could execute arbitrary code in the GitHub Action's context. This could allow unauthorized access to sensitive data, including secrets and permissions within the GitHub repository. The issue has been addressed in version 26.3.0, which mitigates this risk.

References