Black: Beliebige Dateischreibvorgänge durch unsanitierte Benutzereingaben im Cache-Dateinamen

The primary impact of CVE-2026-32274 is the potential for arbitrary file writes. An attacker who can control the value passed to the --python-cell-magics option can dictate the location where Black stores its cache files. This could lead to overwriting critical system files, injecting malicious code, or gaining unauthorized access to sensitive data. The ability to write to arbitrary locations significantly expands the attack surface, potentially allowing for privilege escalation or remote code execution depending on the targeted file and system configuration. While the direct impact is file write, the consequences can be severe.

Developers and DevOps teams using Black in automated pipelines or CI/CD systems are particularly at risk. Environments where Black is integrated with third-party tools or services that provide untrusted input to the --python-cell-magics option are also vulnerable. Shared hosting environments where multiple users have access to the Black command-line interface should be carefully reviewed.

• python / code formatting:

Get-Process -Name Black | Select-Object -ExpandProperty Path

• python / code formatting: Check for unusual cache files in unexpected locations (e.g., /etc/passwd.black_cache). • python / code formatting: Monitor command-line arguments passed to Black for suspicious paths or characters in the --python-cell-magics option. • python / code formatting: Review Black configuration files for any hardcoded or default values for --python-cell-magics that could be exploited.

1. 2026-03-12Disclosure

   disclosure

1. Reserviert2026-03-11
2. Veröffentlicht2026-03-12
3. Geändert2026-03-16
4. EPSS aktualisiert2026-03-23

The primary mitigation for CVE-2026-32274 is to upgrade to Black version 26.3.1 or later, which contains the fix. If upgrading is not immediately feasible, a workaround involves strictly controlling the input provided to the --python-cell-magics option. This means ensuring that only trusted sources provide values for this option, preventing attackers from injecting malicious filenames. Consider implementing input validation and sanitization to further reduce the risk. After upgrading, verify the fix by attempting to trigger the vulnerability with a controlled, malicious --python-cell-magics value; the cache file should not be written to the specified location.