Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-114134— Black: GitHub Action installs unvalidated required-version from pyproject.toml

Quick assessment

Affected
psf black
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Black 是一款绝不妥协的 Python 代码格式化工具。在 26.10.1 版本之前，当 Black 的 GitHub Action 配置为 时，会直接读取 文件中的 字段，而不会验证该值是否为已发布的 Black 版本规范。若攻击者能够提交拉取请求（Pull Request），即可修改该字段，将其指向由攻击者控制的代码，从而在受害者仓库的 GitHub Actions 运行环境中安装并执行恶意代码。该问题已在 26.10.1 版本中修复。

CVSS 8.7 · High
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-114134

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Black: GitHub Action installs unvalidated required-version from pyproject.toml
Source: CVE Program / CVE List V5
Vulnerability Description
Black is the uncompromising Python code formatter. Prior to 26.10.1, the Black GitHub Action with use_pyproject: true accepts tool.black.required-version from pyproject.toml without validating that it is a released Black version specifier. An attacker who can submit a pull request can change that field to a direct reference to attacker-controlled code, causing the workflow to install and execute the code in the victim repository's GitHub Actions context. This issue is fixed in version 26.10.1.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
从非可信控制范围包含功能例程
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
psf black < 26.10.1 -

II. Public POCs for CVE-2026-114134

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-114134

请登录查看更多情报信息。

Other References for CVE-2026-114134 (3)

IV. Related Vulnerabilities

Same product: black
Same vendor: psf
Same weakness: CWE-829