Security incident · CVE-2026-114134
Black: GitHub Action installs unvalidated required-version from pyproject.toml
Published Oct 22, 2026 · catalog updated Oct 22, 2026 · Black: GitHub Action installs
Last checked Nov 6, 2026. A connected source was read within the last 7 days.
Open the advisory
Exploitation likelihood is not on this record for CVE-2026-114134. A missing EPSS score is not a low risk. Compare Black: GitHub Action installs with the linked advisory before you change production.
Gaps on this record
- The stored product name is a package slug. The name on this page is taken from the title (Black: GitHub Action installs).
- No vendor fix or required action is stored. Compare the linked advisory before you change production.
- EPSS is missing. A missing score is not a low risk.
- Severity
- High—
- Known exploitation
- Not in CISA/VulnCheck KEV
- EPSS
- Not in the current FIRST EPSS dataset
- Remediation
- Version ranges on file
- Affected products
- PyPI black · package pip · pip black · pypi black
### Summary The GitHub Action bundled with Black can read the version from if is set to True. This version is not validated and therefore can be used to execute untrusted code in the context of a victim's repository. ### Details This is similar to the previous CVE-2026-31900. The value in is accepted as the version to be installed by the action without validation. ### Proof of concept Reproduction requires a victim to use Black's GitHub Action with . The attacker would then issue a PR to the victim's repository with edited so that Black points to a malicious repository. ### Impact This is a remote code execution vulnerability impacting users using the GitHub Action bundled with psf/black and using the setting.
Are you affected?
Enter the version you run. The result uses only the ranges stored on this record.
The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.
- PyPI black0 → 26.10.1
- package pipversion unspecified
- pip black< 26.10.1
- pypi blackversion unspecified
How to fix CVE-2026-114134
Upgrade
CVE-2026-114134 lists a fix boundary at 26.10.1. Compare the installed build with that boundary before you change production.
Version check
Affected < 26.10.1
Advisory
Open the cve_org record and follow its fix.
Official advisories
What to do
Three questions, each answered from this record only. Confirm the vendor advisory before you patch.
Should you patch?
Exploitation likelihood is not on this record for CVE-2026-114134. A missing EPSS score is not a low risk. Compare Black: GitHub Action installs with the linked advisory before you change production.
Which versions are affected?
Compare what you have installed with 0 → 26.10.1, < 26.10.1. Compare the installed version with the linked vendor advisory before you change production.
What should an analyst verify?
CWE-829: Inclusion of Functionality from Untrusted Control Sphere. EPSS is absent from the current FIRST dataset. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Oct 22, 2026 · GitHub Advisory Database
Detected
### Summary The GitHub Action bundled with Black can read the version from if is set to True. This version is not validated and therefore can be used to execute untrusted code in the context of a victim's repository. ### Details This is similar to the previous CVE-2026-31900. The value in is accepted as the version to be installed by the action without validation. ### Proof of concept Reproduction
Oct 22, 2026 · GitHub Advisory Database
Updated
### Summary The GitHub Action bundled with Black can read the version from if is set to True. This version is not validated and therefore can be used to execute untrusted code in the context of a victim's repository. ### Details This is similar to the previous CVE-2026-31900. The value in is accepted as the version to be installed by the action without validation. ### Proof of concept Reproduction
Oct 22, 2026 · PyPA Advisory Database
Fix available
black fixed in 26.10.1
Oct 22, 2026 · PyPA Advisory Database
Fix available
black fixed in 26.10.1
Oct 22, 2026 · PyPA Advisory Database
Updated
### Summary The GitHub Action bundled with Black can read the version from if is set to True. This version is not validated and therefore can be used to execute untrusted code in the context of a victim's repository. ### Details This is similar to the previous CVE-2026-31900. The value in is accepted as the version to be installed by the action without validation. ### Proof of concept Reproduction
Sources
- CVE.orgVulnerability recordCVE-2026-114134
CVE.org record is not available yet.
cve.org - GitHub Advisory DatabasePackage advisoryGHSA-cg8m-r9f2-5wm2
Black: GitHub Action installs unvalidated required-version from pyproject.toml
github.com - GitLab Advisory DatabasePackage advisoryCVE-2026-114134
The GitHub Action bundled with Black can read the version from tool.black.required-version if use_pyproject is set to True. This version is not validated and therefore can be used to execute untrusted code in the context of a victim's repository.
advisories.gitlab.com - PyPA Advisory DatabasePackage advisoryGHSA-cg8m-r9f2-5wm2
Black: GitHub Action installs unvalidated required-version from pyproject.toml
osv.dev - Snyk Vulnerability DatabasePackage advisorySNYK-PYTHON-BLACK-21431452
Unsafe Dependency Resolution
security.snyk.io
References
Freshness
Last verified in this catalog Nov 6, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.
- GitLab Advisory DatabaseOct 27, 2026
- Snyk Vulnerability DatabaseOct 24, 2026
- GitHub Advisory DatabaseOct 23, 2026
- CVE.orgOct 23, 2026
- PyPA Advisory DatabaseOct 23, 2026