{"id":"CVE-2026-114134","kind":"vulnerability","aliases":["CVE-2026-114134","GHSA-cg8m-r9f2-5wm2"],"related":[],"title":"Black: GitHub Action installs unvalidated required-version from pyproject.toml","description":"### Summary\n\nThe GitHub Action bundled with Black can read the version from `tool.black.required-version` if `use_pyproject` is set to True. This version is not validated and therefore can be used to execute untrusted code in the context of a victim's repository.\n\n### Details\n\nThis is similar to the previous CVE-2026-31900. The value in `tool.black.required-version` is accepted as the version to be installed by the action without validation.\n\n### Proof of concept\n\nReproduction requires a victim to use Black's GitHub Action with `use_pyproject: true`. The attacker would then issue a PR to the victim's repository with `pyproject.toml` edited so that Black points to a malicious repository.\n\n### Impact\n\nThis is a remote code execution vulnerability impacting users using the GitHub Action bundled with psf/black and using the `use_pyproject: true` setting.","summary":"The Black GitHub Action reads the version to install from tool.black.required-version in pyproject.toml when use_pyproject is true, and does not validate it. A pull request that points that value at an attacker-controlled package source can run arbitrary code in the context of the victim's CI run and repository.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"black","fixed":["26.10.1"],"affected":"< 26.10.1","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["black","ci","cwe-829","github-actions","package","python"],"not_affected_if":["default-config","no-required-version-in-pyproject","use_pyproject-not-set"],"how_to_check":"Search the repo's workflow files for psf/black or 'uses: psf/black' with use_pyproject: true.\nCheck pyproject.toml for a [tool.black] section with required-version set.","fix":"Upgrade the Black GitHub Action to a release that includes the fix (affected below 26.10.1, fixed in 26.10.1).\nUntil then, remove use_pyproject: true or drop required-version from pyproject.toml, and review open PRs that edit pyproject.toml.","status":"open","published_at":"2026-10-22T16:18:57+00:00","first_seen_at":"2026-10-23T19:11:31+00:00","triaged_at":"2026-10-23T20:09:59+00:00","updated_at":"2026-10-23T20:09:59+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-23T20:09:59Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade the Black GitHub Action to a release that includes the fix (affected below 26.10.1, fixed in 26.10.1).\nUntil then, remove use_pyproject: true or drop required-version from pyproject.toml, and review open PRs that edit pyproject.toml.","summary":"The Black GitHub Action reads the version to install from tool.black.required-version in pyproject.toml when use_pyproject is true, and does not validate it. A pull request that points that value at an attacker-controlled package source can run arbitrary code in the context of the victim's CI run and repository.","category":"package","who_cares":["github-actions","python","black","ci"],"confidence":0.8,"analyst_note":"Sources do not say whether the GHSA lists a specific action tag or only the PyPI package version; confirm which action ref is fixed at https://github.com/advisories/GHSA-cg8m-r9f2-5wm2 and whether a workaround exists besides removing use_pyproject.","how_to_check":"Search the repo's workflow files for psf/black or 'uses: psf/black' with use_pyproject: true.\nCheck pyproject.toml for a [tool.black] section with required-version set.\nunknown for any other check the sources do not describe.","needs_analyst":true,"not_affected_if":["use_pyproject-not-set","no-required-version-in-pyproject","default-config"],"severity_if_unknown":"high"},"cost_usd":0.000463,"input_tokens":2220,"output_tokens":482,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-114134':13A,21A '-2026':12A,20A,136C '-31900':137C '-829':26B '5wm2':18A 'accept':144C 'action':3A,29B,35B,88C,153C,168C,209C 'arbitrari':72B 'attack':66B,174C 'attacker-control':65B 'black':1A,22A,23B,33B,91C,165C,190C 'bundl':89C,210C 'cg8m':16A 'ci':24B,81B 'code':73B,119C,201C 'concept':158C 'context':76B,122C 'control':67B 'cve':11A,19A,135C 'cwe':25B 'detail':128C 'edit':187C 'execut':117C,202C 'ghsa':15A 'ghsa-cg8m-r9f2-5wm2':14A 'github':2A,28B,34B,87C,167C,208C 'github-act':27B 'impact':196C,204C 'instal':4A,40B,150C 'issu':177C 'malici':194C 'packag':30B,68B 'point':60B,191C 'pr':179C 'previous':134C 'proof':156C 'psf/black':212C 'pull':57B 'pyproject':48B,101C,171C,217C 'pyproject.toml':10A,45B,186C 'python':31B 'r9f2':17A 'read':36B,93C 'remot':200C 'repositori':84B,127C,184C,195C 'reproduct':159C 'request':58B 'requir':7A,160C 'required-vers':6A 'run':71B,82B 'set':103C,219C 'similar':131C 'sourc':69B 'summari':85C 'therefor':112C 'tool.black.required':42B,97C,141C 'true':50B,105C,172C,218C 'untrust':118C 'unvalid':5A 'use':47B,100C,115C,164C,170C,206C,214C,216C 'user':205C 'valid':54B,110C,155C 'valu':62B,139C 'version':8A,38B,43B,95C,98C,107C,142C,147C 'victim':79B,125C,162C,182C 'vulner':203C 'without':154C 'would':175C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T16:18:57+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-cg8m-r9f2-5wm2","url":"https://github.com/advisories/GHSA-cg8m-r9f2-5wm2","severity":"high","published_at":"2026-10-22T16:18:57+00:00","modified_at":"2026-10-22T16:18:58+00:00","first_seen_at":"2026-10-23T19:11:31+00:00","fetched_at":"2026-10-23T19:11:31+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}