Arbitrary File Write Vulnerability in Python Code Formatter Black by PSF
CVE-2026-32274

8.7HIGH

Key Information:

Vendor

Psf

Status
Black
Vendor
CVE Published:
12 March 2026

What is CVE-2026-32274?

The Black code formatter for Python versions before 26.3.1 has a vulnerability that allows an attacker to create cache files in arbitrary locations on the file system due to unsanitized input from the --python-cell-magics option. This flaw permits potentially malicious users to exploit the file naming mechanism, leading to unauthorized file write operations that can compromise the system's security. The issue was addressed in version 26.3.1, which implemented appropriate input validation.

Affected Version(s)

black >= 24.3.0, < 26.3.1

References

https://github.com/psf/black/security/advisories/GHSA-393...
x_refsource_CONFIRM
https://github.com/psf/black/pull/4176
x_refsource_MISC
https://github.com/psf/black/pull/5038
x_refsource_MISC

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.