CVE-2026-31900

Katalog CVE

CVSS 9.8 · Critical EPSS 0,66%

Kerentanan Improper Input Validation pada python black. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

Black is the uncompromising Python code formatter. Black provides a GitHub action for formatting code. This action supports an option, use_pyproject: true, for reading the version of Black to use from the repository pyproject.toml. A malicious pull request could edit pyproject.toml to use a direct URL reference to a malicious repository. This could lead to arbitrary code execution in the context of the GitHub Action. Attackers could then gain access to secrets or permissions available in the context of the action. Version 26.3.0 fixes this vulnerability.

Rincian

Terbit di NVD

11 Maret 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-20: Improper Input Validation

EPSS (30 hari)

0,66% peluang dieksploitasi; lebih tinggi dari 50,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/psf/black/security/advisories/GHSA-v53h-f6m7-xcgm mitigasi · advisory vendor
• https://github.com/psf/black/commit/0a2560b981364dde4c8cf8ce9d164c40669a8611 patch