PYSEC-2026-2121

🗓️ 12 Mar 2026 20:16:06Reported by Python Packaging AdvisoryType

pypa🔗 github.com👁 3 Views

Black 26.3.1 fixes cache file path vulnerability from unsanitized python cell magics option.

Reporter	Title	Published	Views	Family All 46
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - Visual Inspection component uses black-26.1.0 which is vulnerable to CVE-2026-31900	5 May 202609:43	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Edge Data Collector uses black-24.10.0-py3-none-any.whl which is vulnerable to CVE-2026-31900, CVE-2026-32274.	1 May 202612:06	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in Black affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge.	22 Jun 202613:16	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in watsonx.data	13 May 202617:54	–	ibm
ATTACKERKB	CVE-2026-32274	12 Mar 202619:47	–	attackerkb
Chainguard	CVE-2026-32274 vulnerabilities	16 Mar 202619:17	–	cgr
Circl	CVE-2026-32274	12 Mar 202619:16	–	circl
CNNVD	Black 路径遍历漏洞	12 Mar 202600:00	–	cnnvd
CVE	CVE-2026-32274	12 Mar 202619:47	–	cve
Cvelist	CVE-2026-32274 Black: Arbitrary file writes from unsanitized user input in cache file name	12 Mar 202619:47	–	cvelist

Vulners

Node

pypi blackRange0–26.3.1

Source	Link
access	www.access.redhat.com/security/cve/CVE-2026-32274
security	www.security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-32274.json
access	www.access.redhat.com/errata/RHSA-2026:10184
access	www.access.redhat.com/errata/RHSA-2026:13545
access	www.access.redhat.com/errata/RHSA-2026:13553
github	www.github.com/psf/black/releases/tag/26.3.1
github	www.github.com/psf/black/security/advisories/GHSA-3936-cmfr-pm3m
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
github	www.github.com/psf/black/commit/4937fe6cf241139ddbfc16b0bdbb5b422798909d
github	www.github.com/psf/black/pull/5038

13 Jul 2026 05:48Current

7.1High risk

Vulners AI Score7.1

CVSS 3.17.5

CVSS 48.7

EPSS0.00572

SSVC