Black is the uncompromising Python code formatter. Prior to 26.3.1, Black writes a cache file, the name of which is computed from various formatting options. The value of the --python-cell-magics option was placed in the filename without sanitization, which allowed an attacker who controls the value of this argument to write cache files to arbitrary file system locations. Fixed in Black 26.3.1.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
No data.
Advisories
| Source | ID | Title |
|---|---|---|
 Github GHSA |
GHSA-3936-cmfr-pm3m | Black: Arbitrary file writes from unsanitized user input in cache file name |
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Thu, 12 Mar 2026 20:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Black is the uncompromising Python code formatter. Prior to 26.3.1, Black writes a cache file, the name of which is computed from various formatting options. The value of the --python-cell-magics option was placed in the filename without sanitization, which allowed an attacker who controls the value of this argument to write cache files to arbitrary file system locations. Fixed in Black 26.3.1. | |
| Title | Black: Arbitrary file writes from unsanitized user input in cache file name | |
| Weaknesses | CWE-22 | |
| References |
| |
| Metrics |
cvssV4_0
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: GitHub_M
Published:
Updated: 2026-03-12T19:47:07.464Z
Reserved: 2026-03-11T15:05:48.400Z
Link: CVE-2026-32274
Vulnrichment
No data.
NVD
Status : Awaiting Analysis
Published: 2026-03-12T20:16:06.350
Modified: 2026-03-12T21:07:53.427
Link: CVE-2026-32274
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses