CVE-2026-32274: Arbitrary File Access in Black

The core of this vulnerability lies in Black's cache file naming process. When formatting code, Black generates cache files to improve performance. The name of these files is derived from various formatting options, including the --python-cell-magics argument. Critically, the value provided to --python-cell-magics is incorporated into the filename without proper sanitization. An attacker who can control this argument can therefore dictate where Black writes its cache files, potentially overwriting critical system files or injecting malicious content. The blast radius extends to any system where Black is executed with untrusted input to the --python-cell-magics option, potentially leading to system compromise or denial of service.

1. Reserved2026-03-11
2. Published2026-03-12
3. Modified2026-03-16
4. EPSS updated2026-03-23

The primary mitigation for CVE-2026-32274 is to upgrade to Black version 26.3.1 or later, which includes the necessary sanitization to prevent arbitrary file writes. If upgrading is not immediately feasible, a workaround involves strictly controlling the input provided to the --python-cell-magics option. This can be achieved by validating the input to ensure it does not contain malicious characters or paths. Consider implementing input validation at the command-line interface or within the application that invokes Black. There are no specific WAF or proxy rules applicable, as the vulnerability resides within the Black application itself. After upgrading, confirm the fix by attempting to execute Black with a crafted --python-cell-magics argument containing a path traversal sequence (e.g., --python-cell-magics=../../../../etc/passwd) and verifying that the cache file is not written to the intended location.