CVE-2026-32274 Black: Arbitrary file writes from unsanitized user input in cache file name

High 8.7 Published 12 Mar 2026 Updated 3 Aug 2026

An attacker controlling the --python-cell-magics argument can write cache files to arbitrary locations due to unsanitized input in the filename.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2026-32274?

CVE-2026-32274 is a high-severity path traversal vulnerability in psf black, published on 12 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Black is the uncompromising Python code formatter. Starting in version 24.3.0 and prior to version 26.3.1, Black writes a cache file, the name of which is computed from various formatting options. The value of the --python-cell-magics option was placed in the filename without sanitization, which allowed an attacker who controls the value of this argument to write cache files to arbitrary file system locations. Fixed in Black 26.3.1.

Weakness: CWE-22

Which versions are affected by CVE-2026-32274?

3 open source packages ship an affected version, including black. It affects 1 product.

Package	Affected	Fixed in
`black` PyPI	All versions	`26.3.1`
`black` PyPI	From `24.3.0`	`26.3.1`
`black` PyPI	From `24.3.0`	`26.3.1`

Linux distribution packages (2)

`python-black` openSUSE:Leap 15.6	All versions	`24.3.0-150400.9.11.1`
`ansible-lint` openSUSE:Tumbleweed	All versions	`26.9.0-1.1`

Products include Python Black.

How do I fix CVE-2026-32274?

Upgrade black to 26.3.1 or later.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2026-32274 being exploited?

There is no known exploitation of CVE-2026-32274 in the wild and no public exploit code.

CVE-2026-31900 Black's vulnerable version parsing leads to RCE in GitHub Action High 8.7

Sources

Also known as CLEANSTART-2026-XE98234, DEBIAN-CVE-2026-32274, ECHO-c5b6-7968-60af, GHSA-3936-cmfr-pm3m, MINI-rphp-3qhx-5x4v, OESA-2026-4064 and 5 more.