CVE-2026-114134

Name	CVE-2026-114134
Description	Black is the uncompromising Python code formatter. Prior to 26.10.1, the Black GitHub Action with use_pyproject: true accepts tool.black.required-version from pyproject.toml without validating that it is a released Black version specifier. An attacker who can submit a pull request can change that field to a direct reference to attacker-controlled code, causing the workflow to install and execute the code in the victim repository's GitHub Actions context. This issue is fixed in version 26.10.1.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
black (PTS)	bookworm	23.1.0-1	vulnerable
	trixie	25.1.0-3+deb13u1	vulnerable
	forky, sid	26.10.1-1	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
black	source	(unstable)	(unfixed)

Notes

https://github.com/psf/black/security/advisories/GHSA-cg8m-r9f2-5wm2
https://github.com/psf/black/pull/5510
https://github.com/psf/black/commit/ac1f71563aeccf73cf13ece00f231d9d6c66a514 (26.10.1)