CVE-2026-32274

Name	CVE-2026-32274
Description	Black is the uncompromising Python code formatter. Prior to 26.3.1, Black writes a cache file, the name of which is computed from various formatting options. The value of the --python-cell-magics option was placed in the filename without sanitization, which allowed an attacker who controls the value of this argument to write cache files to arbitrary file system locations. Fixed in Black 26.3.1.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
black (PTS)	bullseye	20.8b1-4	vulnerable
	bookworm	23.1.0-1	vulnerable
	trixie	25.1.0-3	vulnerable
	forky	25.12.0-2	vulnerable
	sid	26.1.0-1	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
black	source	(unstable)	(unfixed)

Notes

https://github.com/psf/black/security/advisories/GHSA-3936-cmfr-pm3m
https://github.com/psf/black/pull/5038
Fixed by: https://github.com/psf/black/commit/4937fe6cf241139ddbfc16b0bdbb5b422798909d (26.3.1)