CVE-2026-32274

Name	CVE-2026-32274
Description	Black is the uncompromising Python code formatter. Prior to 26.3.1, Black writes a cache file, the name of which is computed from various formatting options. The value of the --python-cell-magics option was placed in the filename without sanitization, which allowed an attacker who controls the value of this argument to write cache files to arbitrary file system locations. Fixed in Black 26.3.1.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1130657

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
black (PTS)	bullseye	20.8b1-4	vulnerable
	bookworm	23.1.0-1	vulnerable
	trixie	25.1.0-3	vulnerable
	forky, sid	26.3.1-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
black	source	(unstable)	26.3.1-1			1130657

Notes

[trixie] - black <no-dsa> (Minor issue)
[bookworm] - black <no-dsa> (Minor issue)
[bullseye] - black <postponed> (Minor issue)
https://github.com/psf/black/security/advisories/GHSA-3936-cmfr-pm3m
https://github.com/psf/black/pull/5038
Fixed by: https://github.com/psf/black/commit/4937fe6cf241139ddbfc16b0bdbb5b422798909d (26.3.1)