Multiple security vulnerabilities have been identified in the Black GitHub Action, affecting releases earlier than 26.10.1. The issues allow an untrusted version value from project configuration to be accepted without validation when the action is configured to use that setting. This can let an attacker cause execution of untrusted code in a victim repository through a malicious pull request. The overall risk is high because the flaw can lead to remote code execution in affected workflows.
CVE-2026-114134 (CVSS 8.7 — High): The Black GitHub Action can read an unvalidated required-version value from project configuration when configured to use that setting. An attacker with pull-request access can modify the configuration to point to a malicious package source and execute untrusted code in the victim repository.[/subscribe_to_unlock_form]
Multiple security vulnerabilities have been identified in the Black GitHub Action, affecting releases earlier than 26.10.1. The issues allow an untrusted version value from project configuration to be accepted without validation when the action is configured to use that setting. This can let an attacker cause execution of untrusted code in a victim repository through a malicious pull request. The overall risk is high because the flaw can lead to remote code execution in affected workflows.
CVE-2026-114134 (CVSS 8.7 — High): The Black GitHub Action can read an unvalidated required-version value from project configuration when configured to use that setting. An attacker with pull-request access can modify the configuration to point to a malicious package source and execute untrusted code in the victim repository.[emaillocker id="1283"]
CVE-2026-31900: A prior related flaw in the same Black GitHub Action allowed an unvalidated version value to be accepted, enabling an attacker to execute untrusted code in a victim repository.
These vulnerabilities collectively present a serious risk to users who run the affected action with project configuration enabled. The most exposed users are those who accept pull requests from untrusted contributors while using the vulnerable workflow. They should review their exposure and take appropriate action to reduce the chance of malicious code execution.
We recommend you to update Black to version 26.10.1.
The following reports contain further technical details:
[/emaillocker]